Crashing  search  party  Experts  warn  that 

Microsoft's  desktop  search  efforts  raise  new  security  worries.  PAGE  8. 


IBM  on  the  prowl  Big  Blue  has  been  snapping  up 

small  software  firms  at  a  steady  clip.  PAGE  21 . 
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A  Wider  Net 


Hack . . . 
hack  back 
. . .  repeat 


At  DefCon,  a  game 
of  virtual  capture  the 
flag  keeps  eight 
teams  at  the  key¬ 
board  for  36  hours. 


■  BY  ROONEY 
THAYER, 
NETWORK 
WORLD  LAB 
ALLIANCE 

as  Vegas' 


Capture  the  flag  might 
be  only  a  game,  but  it 
was  serious  business  at 
DefCon,  the  world’s  largest 
annual  computer  hacker 
convention.  For  36  straight 
hours,  eight  teams  of  expe¬ 
rienced  hackers  and  seri¬ 
ous  security  professionals 
played  predator  and  prey 
as  they  tried  to  hack  into 
competitors’  networks 
while  defending  their  own. 

From  my  front-row  seat 
as  a  member  of  the  win¬ 
ning  team,Sk3wl  of  ROOt 
(hacker  slang  for  “School 
of  Root,”  where  “root”  refers 
to  gaining  administrator 
access  to  a  system),  I  got  a 
See  DefCon,  page  12 


Trojan  hits 
Windows 
PDAs  for 
first  time 

■  BY  ANN  BEDNARZ 

After  finding  the  third  mali¬ 
cious  program  targeting  wireless 
devices  in  fewer  than  60  days, 
security  specialists  are  warning 
that  it’s  only  a  matter  of  time 
before  attackers  launch  a  serious 
attack  against  mobile  phones 
and  PDAs. 

Kaspersky  Labs  last  week  re 
ported  the  first  incidence  of  a 
Trojan  horse  that  targets  cer¬ 
tain  Windows-based  handheld 

See  PDAs,  page  13 


Fed  up  hospitals 
defy  patching  rules 


■  BY  ELLEN  MESSMER 

Amid  growing  worries  that  Windows- 
based  medical  systems  will  endanger 
patients  if  Microsoft-issued  security 
patches  are  not  applied,  hospitals  are 
rebelling  against  restrictions  from  de¬ 
vice  manufacturers  that  have  delayed  or  prevented 
such  updates. 

Moreover,  the  U.S.  Food  and  Drug  Administration 
(FDA)  is  encouraging  the  aggrieved  hospitals  to  file 
written  complaints  against  the  manufacturers,  which 
could  result  in  devices  losing  their  government  seal 
of  approval. 


If  hospitals  encounter  a  patch-related  issue  “that 
may  lead  to  death  or  serious  injury  they  must  file  a 
report, ’’says  John  Murray  the  FDAs  software  and  elec¬ 
tronic  records  compliance  expert.  Murray  acknowl¬ 
edges  that  healthcare  organizations  might  be  reluc¬ 
tant  to  do  this  “because  they  don’t  want  the  manu¬ 
facturer  mad  at  them.” 

Device  makers  such  as  GE  Medical  Systems, 
Philips  Medical  Systems  and  Agfa  say  it  typically 
takes  months  to  test  Microsoft  patches  because 
they  could  break  the  medical  systems  to  which 
they’re  applied.  In  some  instances,  vendors  won’t 
authorize  patch  updates  at  all. 

See  Patches,  page  16 


Forsee  talks  telecom 

Sprint  CEO  defends  AT &T  deal,  rips  Ebbers. 


Q* 


While  the  telecom  market  as  a  whole  still  strug¬ 
gles  to  find  footing,  the  terrain  looks  somewhat 
more  stable  under  Sprint.  CEO  Gary  Forsee 
recently  sat  with  Network  World  Senior  Editor  Denise 
Pappalardo  and  Associate  News  Editor  Paul  McNamara  in 
Forsee ’s  office  in  Overland  Park,  Kan.,  to  talk  about  the  com¬ 
pany's  strategy,  industry  consolidation  and  a  topic  that 
touched  a  nerve  with  the  generally  measured  telecom  execu¬ 
tive:  the  legal  fate  of  former  WorldCom  boss  Bernard  Ebbers. 


fcft  We  are  not  concerned  that  the 
[AT&T  wireless]  deal  will  disrupt 
our  own  plans  for  our  business* 
customers.  9  9  m 

r.:;&  "  ?  '  Wr- 

Gary  Forsee, < ,1  O.  Sprint 


RON  BERG 


One  of  Sprint's  biggest  differentiators  is  wireless.  Yet  the  deal  you  signed 
with  AT&T  in  May  lets  AT&T  in  on  that  differentiator.  What's  in  this  for 
Sprint? 

The  advantage  for  Sprint  is  that  we  will  be  bringing  new  customers 
on  to  our  network  while  reducing  our  acquisition  costs.  If  there  is 
any  risk  in  enabling  a  company  that  historically  has  been  one  of  our 

See  Forsee,  page  52 


How  do  you  set  your  spam 
filters  to  block  words  like 
Viagra  when  you’re  a  drug 
company  or  a  hospital  and  the 

Viagra  mail  has  to  get  through? 

'  ■  (A  Ml 
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Dan  Lukas  of  Aurora  Health 
Care  offers  his  tips  for 
outsmarting  the  spammers. 


The  ultra  reliable  IBM  eServer  xSeries  365  system  -  with  powerful  Intel®  Xeon™  processors  -  can  make  your  work,  and 
IT  selection  process,  easier.  With  three  levels  of  memory  protection  and  a  comprehensive  monitoring  of  key  components,  it’s 
all  about  uptime.  So  you  get  outstanding  reliability  when  running  mission-critical  ERP,  collaboration  and  database  applications. 
The  works.  Management  is  easier,  too.  You  can  have  around-the-clock  remote  access,  on  demand.  And  system  status  can  be 
available  even  when  powered  off.  For  more  on  highly  available,  manageable  xSeries  servers,  go  to  ibm.com/eserver/advantage 


5  reasons  more  and  more  businesses  are  turning  to  IBM  eServer ™  xSeries*  systems  with  Intel  Xeon  processors. 


Scale  1-16  way  with  select 

IBM  Director  systems 

Linux-ready  through 

Mainframe-inspired 

24/7/365  optional  onsite 

models.  Pay  as  you  grow. 

management. 

the  entire  line. 

technologies. 

hardware  support.1 

@  server 


The  easy  choice.  Dependability. 
IBM  eServer  xSeries  365  system. 


Additional  charges  apply  Standard  support  includes  next-business-day  response  in  some  countries.  IBM.  the  e-business  logo.  eServer.  the  eServer  logo  and  xSeries  are  trademarks  or  registered  trademarks  of  International 
Business  Machines  Corporation  in  the  United  States  and/or  other  countries.  Intel,  Intel  Inside,  the  Intel  Inside  logo  and  Intel  Xeon  are  trademarks  or  registered  trademarks  of  Intel  Corporation  or  its  subsidiaries  in  the 
United  States  and  other  countries.  Other  company,  product  and  service  names  may  be  trademarks  or  service  marks  of  others.  ©2004  IBM  Corporation.  All  rights  reserved. 


The  right  management  should  do  more  than  just  protect. 

It  should  also  enable. 

eTrust"  Security  Management  Software 

In  the  world  of  on-demand  computing,  it's  vital  that  your  IT  environment  be  both  secure  and  accessible.  That's  why  it's  essential  that  you  have 
the  right  security  management  software.  With  eTrust  security  management  software,  you  get  the  very  best  in  access,  identity,  and  threat 
management  all  seamlessly  integrated  with  your  existing  technology.  On  the  one  hand,  you  can  rest  assured,  knowing  that  your  information  is 
safe  from  prying  eyes.  At  the  same  time,  you  don't  have  to  worry  about  partners,  customers  or  employees  being  locked  out  of  areas  that  they 
need  to  access  to  optimize  business.  Best  of  all,  eTrust  can  give  you  a  single  view  of  your  entire  enterprise,  putting  you  in  complete  control.  As 
a  result,  you  can  make  real-time  decisions  based  on  comprehensive  information.  So  if  you're  looking  for  ways  to  minimize  risk  while  maximizing 
your  potential,  or  to  get  a  white  paper,  go  to  ca.com/security. 
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e-voting. 
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■  27  VoIP  providers:  Regulation 
hampers  growth. 
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Management 

Strategies 


Getting  a  handle  on  the  information 
stewardship  equation. 


■  43  IT  contract  management: 
Manufacturer's  homegrown  system 


tracks  thousands  of  telecom  and 
product  agreements. 


Pieter  SchoehuUs,  IT  director  at 
Flowserve,  has  gotten  a  handle 
on  his  company's  many  con¬ 
tracts  via  a  homegrown  manage¬ 
ment  application. 


Features 

Word  up 

IT  execs  at  spam-magnet  companies  come  up  with 
creative  ways  to  block  spam  while  keeping  the  legitimate 
Viagra/weight-loss/investment  opportunity  e-mails 
flowing.  Page  39. 


CLEAR  CHOICE 

§ 

TEST 

Managing  digital  certificates 


GoreStreet  offers  an  effective  but  complex  way  to  manage  digital  certificates. 

Page  41. 
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Exclusive 

Network  World  Fusion  Radio: 

Wireless  WAN  access  and  the  enterprise 

In-Stat/MDR  just  released  a  survey  that  looks  at  wireless  WAN  services 
and  usage.  Becky  Diercks,  principal  analyst  for  wireless  data  and  Internet 
at  In-Stat/MDR,  discusses  the  findings.  Stream  it  or  download  it  for  later 
use.  DocFinder:  3235 

Fitting  OGSP  into  your  certificate 
infrastructure 

As  part  of  our  review  of  CoreStreet's  Real  Time  Credentials  (page  41), 
head  online  to  learn  how  you  can  fit  Online  Certificate  Status  Protocol  into 
your  digital  certificate  infrastructure.  DocFinder:  3241 

You’ve  Got  the  Power  Survey 

Spread  your  influence  by  casting  your  votes  in  this  first-of-its-kind  survey 
gauging  crucial  questions  of  industry  power,  from  executive  hairstyles  to 
comedic  appeal.  DocFinder  3236 

2004  Salary  Calculator 

Are  you  making  what  you're  worth?  Input  some  details  about  yourself,  and 
we'll  tell  you  if  you  earn  as  much  as  your  peers.  DocFinder  3237 

Gall  for  Nominations:  2004  Network  World 
Reader-Recognition  Awards 

Send  in  your  choices  for  the  2004  Extended  Enterprise  Innovator  Award 
and  the  2004  User  Excellence  Award.  DocFinder  2747 
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Columnists 

The  Wireless  Wizards 

The  future  of  public  WLAN  hot  spots 

The  Wizards  help  a  reader  who  asks:  "What's  the  future  of  free 
hot  spots  at  hotels,  restaurants,  etc.?"  DocFinder  3238 

Small-Business  Tech 

Tough  love  from  Microsoft 

The  new  Windows  XP  security  upgrade  could  trash  your  systems. 
Columnist  James  Gaskin  recommends  two  back-up  options. 

DocFinder  3239 

HomeBase 

Ulfelder  unplugged,  Part  2 

Our  hero,  Columnist  Steve  Ulfelder,  gets  his  WLAN  up  and 
running  with  a  little  help.  DocFinder  3240 

Seminars  and  events 


Weekly  Webcast  Newsletter 

The  Webcast  Newsletter  brings  you  information  on  Webcasts  on 
Network  World  fusion  —  your  24-7  source  for  the  latest  solu¬ 
tions  and  strategies,  with  links,  resources  and  answers  you 
need.  Covering  topics  such  as  security,  applications  and  wireless, 
our  Webcasts  are  highly  focused,  single-topic  briefings  from 
experts  in  technology.  Sign  up  today.  DocFinder  2542 

Breaking  News 

Go  online  for  breaking  news  every  day  DocFinder  6342 

Free  e-mail  newsletters 

Sign  up  for  any  of  more  than  40  newsletters  on  key  network  topics 

DocFinder:  6343 

What  is  DocFinder? 

We’ve  made  it  easy  to  access  articles  and  resources 
online.  Simply  enter  the  four-digit  DocFinder  number  in 
the  search  box  on  the  home  page,  and  you’ll  jump 
directly  to  the  requested  information. 
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Audit  raps  Cisco’s  ‘wired’  contract  win 

9  Findings  of  collusion  between  the  city  of  San  Jose  and  Cisco  over 
an  $8  million  network  installation  contract  is  causing  controversy 
for  the  network  vendor.  According  to  stories  published  in  the  San 
Jose  Mercury  News  last  week,  an  audit  by  the  city  found  that  Cisco 
was  the  only  vendor  considered  to  build  a  converged  IP  voice  and 
data  network  in  San  Jose’s  new  $388  million  city  hall.  As  a  result, 
only  resellers  of  Cisco  gear  were  allowed  to  bid  on  the  project.  Now 
the  city  will  have  to  restart  the  bidding  process  for  the  project  and 
give  Cisco  competitors  a  chance.  A  Cisco  spokeswoman  told  the 
Mercury  News  that  the  vendor  is  cooperating  fully  with  the  city’s 
audit  and  investigation.  The  newspaper  also  reported  that  a  major 
sticking  point  with  the  Cisco  deal  was  that  the  Cisco  IP  telephone 
system  would  not  be  compatible  with  other  vendors’ products,  forc¬ 
ing  the  city  to  only  buy  Cisco  gear  in  the  future  —  a  violation  of  city 
requirements  on  technology  projects. 

FGG  targets  wireless  spam . . . 

■  The  FCC  voted  last  week  to  outlaw  all  unauthorized  text  messages  to  mobile  phones 
and  pagers  unless  the  owner  has  given  permission.  Congress  required  the  FCC  to  adopt 
rules  for  mobile-phone  spam  when  passing  the  CAN-SPAM  law  last  year.  CAN-SPAM  lets 
spammers  send  unsolicited  commercial  e-mail  to  computer  e-mail  accounts  until  the 
recipient  opts  out  of  receiving  e-mail  from  that  sender,  but  the  FCC’s  action  last  week 
requires  that  commercial  entities  sending  text  messages  to  mobile  phones  and  pagers  get 
customers’  opt-in  permission  before  sending  messages.  Commissioners  argued  mobile- 
phone  spam  is  harmful  to  consumers  because  they  often  have  to  pay  for  the  time  it  takes 
to  delete  the  message.  Violators  of  the  FCC  regulations  would  be  subject  to  penalties 
under  CAN-SPAM,  which  allows  fines  of  up  to  $6  million  and  up  to  a  year  in  jail  for  some 
spamming  activities. 

. . .  while  letting  law  enforcement  tap  VoIP 

sITne  FCC  last  week  took  the  first  step  toward  requiring  VoIP  providers  to  comply  with  law 
enforcement  wiretapping  requests.The  FCC  voted  to  begin  an  examination  of  the  policies 
needed  to  ensure  that  VoIP  providers  comply  with  the  1994  Communications  Assistance 
for  Law  Enforcement  Act,  which  lets  U.S.law  enforcement  agencies  listen  in  on  telephone 
conversations. The  commission’s  decision  included  a  tentative  finding  that  communica¬ 
tions  services  offered  over  broadband  pipes,  including  VolPare  subject  to  CALEA  require¬ 
ments  to  comply  with  law  enforcement  wiretap  requests.The  tentative  rules  also  would 
cover  managed  communications  services  offered  over  broadband  connections,  includ¬ 
ing  managed  instant  message  or  video  services,  says  Ed  Thomas,  chief  of  the  FCC  Office 

C  0  VP  E  N  D  I  U  M 

Know  your  enemy 

Wow  to  Bypass  Most  Firewall  Restrictions  and  Access  the  Internet  Privately"  shows 
<eopls  how  to  evade  all  those  firewalls  and  proxies  and  stuff  you  keep  putting  on 
your  network  so  they  can  browse  pom  or  whatever. 

Read  more  at  www.nwfusion.com,  DocFinder:  3250. 
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Thanks  for  the  IETF.  The  Internet  Society  has  named  Phill  Gross  as 
this  year’s  winner  of  the  Jonathan  B.  Postel  Service  Award  in  recognition  for  his 
role  as  co-founder  of  the  IETF  in  1986.  Steve  Crocker,  head  of  the  award  committee,  said: 
"Many  of  the  lETFs  current  structures,  including  working  groups,  technical  areas, 
proceedings  and  Internet  drafts  came 
about  thanks  to  Phill’s  dedication 
and  passion  for  the  Internet 
standards  area."  Gross  is 
director  of  academics 
and  technology  for  the 
Northern  Virginia  ECPI 
College  of  Technology. 


Buddy  system. 

Daniel  Drath,  a  vice 
president  with  Teenage 
Research  Unlimited,  a 
Northbrook,  III.,  market 
research  company, 
commented  last  week  on 
the  sometimes  unusual 
network  habits  of 
teenagers:  "They  can  have 
200  names  on  a  buddy  list, 
but  they've  actually  met  only 
a  few  of  those."  > 


We  tried  to  tell  ya. 


We  ran  a  Tester's  Challenge  story  in  November,  (www.nwfusion.com,  DocFinder: 
3251),  calling  for  security  product  vendors  to  shut  off  unsecure  SSH1  connections. 
Vendors  pooh-poohed  the  argument,  but  last  week  Juniper  issued  a  vulnerability 
advisory  regarding  this  very  type  of  access  for  one  of  its  NetScreen  firewalls. 


of  Engineering  and  Technology.  Nonmanaged  peer-to-peer  services,  including  consumer- 
grade  instant-messaging  services  and  noncommercial  VoIP  services,  likely  would  not  be 
subject  to  CALEA  regulations  under  the  proposed  order,  FCC  staff  members  say 

AOL  buys  challenge/response  spam  blocker 

■  AOL  has  snapped  up  Web-based  e-mail  company  Mailblocks  to  improve  its  own  e-mail 
services  with  greater  anti-spam  protection,  mail  management  and  interface  improvements, 
it  said  last  week.  AOL  did  not  specify  the  terms  of  the  deal  but  said  the  buy  of  privately  held 
Mailblocks  was  aimed  at  gaining  its  challenge/response  technology  for  fighting  spam  and 
authenticating  legitimate  e-mail  senders.  Mailblocks’  technology  works  by  whitelisting 
everyone  in  a  user’s  address  book  as  a  legitimate  e-mail  sender  and  challenging  any 
unknown  senders.  When  a  user  receives  an  e-mail  from  an  unknown  sender,  the  service 
holds  the  mail  and  sends  back  an  automatically  generated  message,  asking  the  sender  to 
type  in  the  seven-digit  code  they  see  on  the  screen.  Once  the  sender  enters  the  code,  the 
message  is  delivered  to  the  recipient,  and  that  sender  will  not  be  challenged  again. 

SP2  for  Windows  XP  days  away 

■  Microsoft  expects  to  finalize  work  on  Service  Pack  2  for  Windows  XP  in  the  coming 
days. The  much-anticipated  security-focused  update  should  be  available  to  users  shortly 
after  that,  a  company  spokesman  said  last  week.  Microsoft  had  hoped  to  wrap  up  work  on 
SP2  last  week.  However,  the  plans  changed  to  ensure  that  the  software  meets  quality  stan¬ 
dards,  the  company  said. The  delay  of  the  release  turned  into  a  public  relations  snafu  for 
Microsoft.  Apparently  unaware  of  the  change  of  plans,  Microsoft  Australia  last  week  issued 
a  statement  announcing  the  release. The  statement  was  later  retracted,  with  company  offi¬ 
cials  saying  the  announcement  was  premature.  SP2  will  be  available  through  downloads, 
retail  distribution  and  free  CDs,  and  on  new  PCs.  For  most  users,  the  download  will  be 
between  80M  and  100M  bytes  in  size,  according  to  Microsoft.To  facilitate  the  large  down¬ 
load,  Microsoft  also  is  updating  its  Windows  Update  service. 


Consider  the  dots  connected.  The  end-to-end  voice  over  IP  solution  we  designed 
for  Crate  and  Barrel  features  a  unified  IP  messaging  platform  and  the  most  advanced 
hardware  available.  The  new  system  will  save  them  a  bundle  on  maintenance,  management 
and  wiring,  while  easing  the  cost  and  complexity  of  adding  features  or  employees.  And 
it’s  already  improving  productivity,  helping  over  400  associates  make  millions  of  customers 
feel  nght  at  home.  To  find  out  more,  go  to  sbc.com/dots.  GOING  BEYOND  THE  CALL.' 
registered  trademarks  of  SBC  Knowledge  Ventures,  L.P.  an0r  &  abates.  O20W  SBC  Knowledge  Ventures,  L.P.  Ai;  rights  reserved. 
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Digging  into  Microsoft’s  search  efforts 

Desktop  could  be  at  security  risk  under  universal  search  plans,  experts  warn. 


Microsoft's  search 

Microsoft  is  building  toward  a  universal  file  system  that 
will  let  users  search  for  information  and  documents 
across  local  drives,  network  drives  and  the  Web.  Here 
is  a  look  at  some  of  the  technology  under  development. 


Product 

Capabilities 

Expected 

release 

SQL  Server 
2005 

Yukon  technology  provides 
search/query  features  that  will 
extend  to  the  next  version  of 
Exchange. 

2005 

Local  PC  File 
Search 

Builds  a  searchable  index  of 
everything  on  a  local  hard  drive. 

2005 

Longhorn 

WinFS.  Bill  Gates  calls  it  his 
Holy  Grail,  a  universal  file 
system  that  extends  search 
from  the  local  PC  to  the  Web. 

2006  (client)  and 

2007  (server) 

»  BY  JOHN  FONTANA 

Microsoft’s  developing  desktop 
search  technology  will  have  to  be 
complemented  by  a  well-defined 
security  framework,  or  it  will  be¬ 
come  a  nightmare  when  inte¬ 
grated  into  a  corporate  collabora¬ 
tion  environment,  experts  say 

The  company  recently  showed 
off  its  newest  search  technology 
Local  PC  File  Search,  which  in¬ 
dexes  every  keyword  and  num¬ 
ber  stored  on  a  hard  drive.  With 
that  index  a  user  can  search  his 
hard  drive  for  such  things  as 
e-mail,  documents,  contacts  and 
calendar  items. 

Developed  collaboratively  by 
Microsoft’s  Office,  Research,  Long¬ 
horn  and  Knowledge  Inter¬ 
change  teams,  the  technology  is 
designed  to  help  Microsoft  in  its 
battle  with  Google,  Yahoo  and 
other  search  companies  to  attract 
consumers.  But  the  technology 
also  is  destined  to  be  part  of 
Microsoft’s  enterprise  platform. 

Experts  say  local  search,  which 
Microsoft  is  expected  to  debut 
next  year,  is  a  necessary  tool  in  a 
day  and  age  where  40G-byte  hard 
drives  are  the  norm.  But  the 
downside  is  that  such  an  index 


creates  a  security  and  privacy  risk 
if  used  as  part  of  an  information¬ 
sharing  or  integrated-search  envi¬ 
ronment  that  includes  multiple 
users,  network  servers  and  intra¬ 
net  sites. 

“If  Microsoft  isn’t  planning  to 
look  at  this  as  a  security  frame¬ 
work  built  into  the  platform,  it 
will  be  a  loaded  rifle,” says  Peter 
O’Kelly,  an  analyst  with  Burton 
Group.  “People  will  find  that 
they  are  sharing  things  that  they 
hadn’t  intended  to  share.”  It’s 
not  just  about  search,  O’Kelly 
says:  It’s  about  everything  bad 
that  can  happen  after  data  is 
compromised. 

For  years  Microsoft  has  been 
building  toward  such  a  universal 
search  technology,  which  will  see 
its  first  incarnation  next  year  with 
the  Yukon  technology  in  SQL 
Server  2005.  That  eventually  will 
expand  with  Yukon  support  in 
Exchange  Server  before  reaching 
Longhorn  and  the  WinFS  univer¬ 
sal  file  system,  which  Chief  Soft¬ 
ware  Architect  Bill  Gates  calls  his 
Holy  Grail  because  it  provides  a 
unified  repository  for  all  data. 

“The  issue  is  you  better  make 
sure  you  protect  that  index,  you 
better  make  sure  there  is  no  path 


to  that  index”  for  anyone  other 
than  the  PC’s  owner,  says  John 
Pescatore,an  analyst  with  Gartner. 
“Once  you  start  to  index  every¬ 
thing  you  start  to  expose  things 
that  no  one  human  could  find  on 
their  own.” 

The  index  could  become  a  trea¬ 
sure-trove  for  hackers  who  target 
Microsoft’s  client  operating  sys- 
tem.Today’s  Windows  desktop  file 
sharing  technology  already  has 


proven  it  can  be  a  security  risk. 

Pescatore  says  any  search  tech¬ 
nology  that  peeks  into  a  local 
hard  drive  will  have  to  be  cor¬ 
ralled  by  an  “opt-in”  model  that 
lets  users  pinpoint  what  is  ex¬ 
posed  and  what  is  hidden. 

That  is  just  the  technology  cur¬ 
rently  under  development  by 
desktop  search  vendor  XL  The 
company  is  a  competitor  to 
Lookout  Software,  which  Micro¬ 


soft  acquired  last  month. 

“We  are  working  on  indexes 
that  can  be  subscribed  to,"  says 
Mark  Goodstein,  founder  of  XL 
He  says  the  company  put  XI, 
which  indexes  e-mail,  files, attach¬ 
ments  and  contacts,  on  its  net¬ 
work  with  an  index  to  Temp 
Folders  stored  on  local  PCs. 
Goodstein  says  the  test  revealed 
that  even  with  only  one  folder 
exposed,  sensitive  data  including 
salary  information  was  available 
on  the  network. 

“This  data  was  protected  before 
just  because  it  was  opaque.  Once 
you  create  an  index  you  find 
some  interesting  things,”  Good¬ 
stein  says. 

He  says  the  issue  needs  a  solu¬ 
tion  today  because  companies 
are  asking  for  integration  of  XI 
with  collaboration  tools  such  as 
Groove  and  Microsoft’s  Share- 
Point  Services. 

Microsoft  already  has  devel¬ 
oped  some  protection  features 
such  as  in  SharePoint,  which  lets 
users  set  up  protected  file  shares, 
and  with  digital  rights  manage¬ 
ment  technology  to  protect  docu¬ 
ments  and  data.  The  vendor  also 
is  building  an  identity  manage¬ 
ment  platform  around  Active 
Directory  for  sophisticated  au¬ 
thentication  and  authorization 
access  controls. 

“I  don’t  think  these  security 
issues  are  any  worse  than  they 
are  today  with  search,”  says  Peter 
Pawlak,  an  analyst  with  research 
firm  Directions  on  Microsoft. 
“Sure  there  is  a  huge  security 
aspect  to  desktop  search,  but 
Microsoft  is  putting  too  much 
work  into  security  to  be  sloppy 
about  this.” 

The  issue  that  really  concerns 
Pawlak  is  improving  the  overall 
search  features  in  Windows, 
which  he  calls  primitive  com¬ 
pared  to  the  concept  of  Long¬ 
horn’s  WinFS. 

“I’m  more  worried  if  it  will  be 
fast  enough,  capable  enough,” 
he  says.  ■ 


Correction 


■  The  story  "Business  DSL 
more  popular  than  flashy" 

(Aug.  2,  page  25)  misidentified 
Bruce  McGregor,  analyst, 
broadband  services,  of  Current 
;  Analysis. 


Intelliden  gobbles  up  competitor 


■  BY  DENISE  DUBIE 

Management  software  company  Intelliden 
iast  week  said  it  has  acquired  competitor 
Gold  Wire  Technology  in  a  deal  that  will  result 
in  products  that  marry  configuration  and 
compliance  management. 

Industry  watchers  say  the  combined  com¬ 
pany,  in  turn,  might  make  an  attractive  acqui¬ 
sition  target  for  a  larger 
vendor. 

“All  major  management 
vendors  have  made  promi¬ 
nent  moves  to  focus  on  con¬ 
figuration  and  change  man¬ 
agement,  [as  with]  HP’s 
Novadigm  and  Consera  ac¬ 
quisitions  and  BMC’s  Mar¬ 
imba  buyf  says  Glenn  O’Don¬ 
nell.  program  director  at 
Meta  Group.  “There  remains 
lots  of  loom  for  additional 
[merger  and  acquisition] 
activity’ 

Privately  held  Intelliden, 
which  describes  itself  as 
cash  flow-positive  but  re¬ 
veals  little  else  about  its 


financials,  declined  to  say  how  much  it  paid 
for  Gold  Wire,  a  Waltham,  Mass.,  company  that 
started  in  1997  and  has  about  20  employees. 

However,  Intelliden  did  give  some  insight 
into  how  its  products  will  be  blended  with 
Gold  Wire’s  and  promised  a  more  detailed 
road  map  in  60  days. 

“Gold  Wire’s  technologies  will  round  out 
three  of  our  four  product  pillars,”  says  Dale 
Hecht,  Intelliden’s  president 
and  CEO. 

He  says  the  company’s 
auditing  engine  will  benefit 
from  Gold  Wire  network  com¬ 
pliance  capabilities;  its  con¬ 
figuration  and  access  man¬ 
agement  products  will  take 
advantage  of  Gold  Wire’s  sin¬ 
gle  sign-on  features;  and  that 
the  two  companies  also  will 
integrate  their  security  prod¬ 
ucts  into  Intelliden’s  R-Series 
products.  Intelliden  also  sells 
provisioning  software. 

Gold  Wire’s  appliance- 
based  packaging  of  its  soft¬ 
ware  also  gives  Intelliden 
customers  an  alternative  to 


Intelliden’s  software  offerings,  Hecht  says. 

Intelliden,  based  in  Colorado  Springs,  says  it 
has  25  customers,  while  Gold  Wire  has  15. 

The  combined  company’s  competitors 
include  Alterpoint,  Rendition  Networks  and 
Voyence  in  what  is  seen  by  industry  watch¬ 
ers  as  a  growth  market,  given  that  research 
shows  more  than  60%  of  network  and  per¬ 
formance  failures  are  because  of  configura¬ 
tion  errors. 

“Configuration  management  can  offer  in¬ 
stant  results  by  automating  manual  tasks  and 
reducing  errors,”  says  Dennis  Drogseth,  vice 
president  at  Enterprise  Management  Assoc¬ 
iates.  “Configuration  also  ensures  data  integri¬ 
ty,  which  is  at  the  basis  of  compliance.” 

Intelliden  officials  argue  that  adding  Gold 
Wire’s  compliance  management  tools  could 
give  Intelliden’s  configuration  management 
products  an  edge  over  competitors’.  Intelliden 
and  Gold  Wire  already  partner  with  IBM  and 
HP  to  supplement  their  product  lines. 

“More  than  50%  of  our  customers  signed  on 
with  compliance  as  the  drived  says  Jonathan 
Wolf,  a  Gold  Wire  co-founder.  Intelliden  says  it 
signed  a  new  customer  last  week  based  on 
the  availability  of  Gold  Wire’s  compliance  fea¬ 
tures  in  Intelliden’s  product  offerings.* 


More  online! 

Which  new  technologies  best  improve 
network  performance?  Which  break¬ 
throughs  in  caching  and  compres¬ 
sion  free  up  WAN  capacity?  Find  out 
by  listening  to  highlight's  from  Jim 
Motzler  s  keynote  presentation  on 
effective  network  management. 
DocFinder:  1542 
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Now  the  BlackBerry"  Enterprise  Solution  allows  your  business 
applications  to  be  accessed  virtually  anywhere.'  Whether  it's  email, 
ERP,  CRM  or  document  management  systems,  our  solution  is  built 
on  an  open,  secure  platform  that  can  wirelessly  extend  your  existing 
applications  so  you  won't  have  to  rebuild  or  replace  them.  Best 
of  all,  the  BlackBerry  Enterprise  Solution  is  a  proven  platform, 
deployed  by  tens  of  thousands  of  organizations  around  the  world, 
which  means  wireless  access  to  data  can  be  managed  by  your  IT 
staff  with  more  confidence. 


The  BlackBerry  Enterprise  Solution  Difference 

•  Provides  advanced  security  including  triple  DES 
encryption,  handheld  password  protection, 
wireless  IT  security  commands  and  policies 

•  Includes  server  software,  wireless  handhelds, 
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•  Provides  flexible  application  deployment  - 
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News 


Campuses  face  complex  regulations 

Changing  landscape  puts  services  —  and  revenue  —  in  question. 


Hot  FCC  issues  for  campuses 

VoIP:  Which  services  will  be  regulated,  and  priced,  as  traditional 
phone  services,  and  which  given  wider  leeway  as  information 
services? 

E911  services:  Will  the  FCC  issue  time-specific  mandates  to 
implement  pinpoint  location  services  for  emergency  calls? 
Campuses  are  still  left  to  work  out  implementation  details  with 
state  authorities. 

WLAN-cellular  interoperability:  Emerging  issue  on  how  to 
handle  voice  calls  that  span  WLANs  and  cellular  nets;  ACUTA 
organizing  to  address  this  with  carriers  and  the  FCC. 


m  SY  JOHN  COX 

CHICAGO  —  Federal  uncer¬ 
tainty  over  telecom  policy  has  left 
network  executives  in  higher  edu¬ 
cation  pondering  cost  trends, 
technology  bets  and  campus 
infrastructure  options. 

But  the  growing  availability  of 
broadband  access,  coupled  with 
the  surge  in  commercial  VoIP 
services,  is  likely  to  force  the  FCC 
to  take  action  on  at  least  some 
issues  in  the  next  12  months, 
according  to  Jeff  Linder,  a  spe¬ 
cialist  in  telecom  regulation  and 
a  partner  in  Wiley,  Rein  & 
Fielding,  a  Washington,  D.C., 
law  firm. 

He  spoke  at  last  week’s  annual 
conference  of  the  Association 
for  Communications  Technology 
Professionals  in  Higher  Educa¬ 
tion,  still  known  by  its  original 
acronym,  ACUTA. 

Key  issues  include  how  and  to 
what  degree  IP-based  telecom 
services  will  be  regulated  and 
priced;  the  decline  in  college  rev¬ 
enue  from  reselling  phone  ser¬ 
vice  to  students;  and  federal  and 
state  roles  in  the  emerging  ques¬ 
tion  of  wireless  LAN  (WLAN)  and 
cellular  interoperability 

ACUTA  goes  on  the  offensive 

In  the  past  two  years,  ACUTA 
has  expanded  its  Washington, 
D.C.,  presence  in  part  because  of 
the  changes  taking  place  in  tele¬ 
com  and  the  emergence  of  IP 
networks,  said  Walter  Czerniak, 
association  president  of  the 
organization. 

More  importantly,  the  group 
has  shifted  from  a  defensive 
strategy,  which  ensured  that  rule 
changes  don’t  hurt  institutions, 
to  a  proactive  strategy,  by  engag¬ 
ing  the  FCC  staff  on  a  range  of 
issues,  often  in  partnership  with 
other  fiigher  education  groups. 

“It’s  gotten  to  the  point  where 
the  FCC  will  now  call  and  ask  us 


what  we  think  of  some  new  ven¬ 
dor  proposal,”  Czerniak  said. 

Linder  is  emphatic  that  ACUTA 
and  similar  small  but  focused 
groups  can  have  an  effect  on 
FCC  deliberations. 

“ACUTA  brings  real  interests 
and  expertise  on  specific  issues,” 
he  said. “Instead  of  submitting  a 
200-page  document  that  vaguely 
covers  all  points,  you  file  a  five- 
page  document  that  says, ‘Here’s 
our  experience  in  this  area,  and 
what  it  means’ The  FCC  staff  will 
[actually]  read  these.” 

ACUTAs  involvement  in  policy 
matters  is  not  an  academic  exer¬ 
cise.  Colleges  and  universities 
have  long  had  a  lucrative  busi¬ 
ness  reselling  phone  service  to 
students. 

That  revenue  stream,  coupled 
with  telecom  charge-back  poli¬ 
cies  to  college  departments,  has 
funded  campus  telecom  infra¬ 
structures  for  years. 

But  that  revenue  is  evaporat¬ 
ing  as  more  students  arrive  on 
campus  with  cell  phones,  as 
VoIP  and  other  IP-based  carrier 
services  proliferate,  and  as  com¬ 
petition  continues  to  hammer 
profit  margins  on  phone  service 
razor  thin. 

“ACUTA  encourages  the  expan¬ 
sion  of  IP-enabled  services,”  said 
Randal  Hayes,  chairman  of 
ACUTA’s  Legislative/Regulatory 


Affairs  Committee.  “But  in  trans¬ 
forming  the  communications  in¬ 
frastructure  from  switched  to  IR 
you  have  to  address  the  new 
technology  in  a  way  that  makes 
sense,  but  without  causing  the 
old  plant  to  fall  apart.” 

“VoIP  is  a  disruptive  technol¬ 
ogy”  Linder  told  his  ACUTA  audi¬ 
ence.  “It’s  platform-independent: 
You  don’t  need  to  control  the 
underlying  network  to  offer  VoIP 
[and  related]  services.lt  really  is 
becoming  reality,  and  very 
quickly” 

That’s  because  many  of  the 
technical  problems  have  been 
solved,  and  the  spread  of  broad¬ 
band  access  to  the  public  net¬ 
work  makes  VoIP  services  feasi¬ 
ble  for  a  mass  market.  But  it’s 
unclear  how  these  trends,  and 
the  FCC’s  response,  will  affect 
campuses. 

VoIP  rate  questions 

The  FCC  is  examining  the  im¬ 
plications  of  exempting  IP-based 
telephony  services  from  fees 
for  network  access,  Universal 
Service  and  other  traditional 
charges. 

Linder  said  there  seems  to  be 
an  emerging  consensus  that  VoIP 
is  clearly  an  alternative  to  tradi¬ 
tional  voice  calls  and  can  be 
treated  in  a  similar  way,  with 
some  traditional  access  fees. 

“In  about  a  year,  you’ll  get  a 
more  rational  rate  structure,” 
Linder  predicted.“But  it’s  a  politi¬ 
cal  nightmare  for  the  FCC.  And 
it’s  immensely  complicated.  The 
FCC  will  be  forced  to  act  on  this.” 

A  closely  related  question  is 
whether  the  states  will  regulate 
VoIP  and  other  emerging  ser¬ 
vices  that  use  their  traditional 
regulatory  structures  and 
assumptions.  The  FCC  is  under 
growing  pressure  to  stake  out  IP 
services  as  a  federal  domain, 
Linder  said. 


Another  area  of  confusion  for 
some  campuses  is  the  need  to 
ensure  that  students  can  get 
emergency  service.  The  FCC 
mandate  for  Enhanced  91 1  ser¬ 
vices,  to  provide  pointpoint 
accuracy  to  locate  cellphone 
emergency  calls,  is  an  ongoing 
area  of  confusion  for  some  cam¬ 
puses.  Schools  have  to  ensure 
that  residential  students  can  get 
E91 1  serivce. 

The  FCC  still  struggles  with  the 
question  of  whether  to  fix  a 
deadline  for  a  resolution,  or  let 
carriers,  IP  service  providers  and 
equipment  makers  make  their 
own  progress,  Linder  said. 

In  the  meantime,  campuses  are 
left  pretty  much  on  their  own  to 
work  out  E911  arrangements 
with  state  authorities.  South  Car¬ 
olina,  for  example,  so  far  has  not 
adopted  its  own  E911  standard, 
says  Heather  Mitchel,  telephone 
system  and  campus  intranet 
administrator  at  Wofford  College, 
a  small  school  of  about  1,100 
mainly  residential  students  in 
Spartanburg,  S.C.  “Without  that, 
it’s  harder  for  us  to  ensure  stu¬ 
dents  can  get  help”  on  a  timely 
basis,  she  says. 

“ACUTA  advocates  close  part¬ 
nerships  between  campus  pub¬ 
lic  safety  and  local  [external] 
jurisdictions,”  ACUTA’s  Hayes 
said. 

A  just-emerging  area  of  techni¬ 
cal  and  regulatory  confusion  is 
voice  calls  that  might  traverse 
WLAN  and  cellular  networks. 
Products  are  coming  out  (see 
www.nwfusion.com,  DocFinder: 
3255)  but  there  are  no  standards 
or  rules  for  interoperability 

ACUTAs  Czerniak  said  the  asso¬ 
ciation  has  just  begun  internal 
talks  about  this  subject  and  will 
form  a  committee  or  working 
groups  to  engage  carriers  and 
the  FCC.  ■ 


More  online! 


Listen  to  highlights  of  Network  World's 
Webcast  from  Johna  Till  Johnson's 
keynote  presentation  on  ways  to  maximize 
your  VoIP  investment. 

DocFinder:  1541 
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Capture  the  flag,  hacker-style 


At  DefCon,  teams  of  hackers  and  security  professionals  play  a  game  of  virtual  capture  the  flag,  in  which 
they  attempt  to  bring  down  competitors'  network  resources  while  defending  their  own  from  the  latest 
and  greatest  hack  attacks.  All  teams  start  with  the  same  version  ofWindows  and  an  identical  set  of 
network  applications.  Here's  a  winning  strategy: 

i - Teams - 


1 


O  Keep  pipeline  open 
to  Scorebot. 


©  Harden  Windows 
servers  to  protect 
against  attacks. 


©  Defend  network 
against  attacks. 


O  Probe  enemy  machines  for 
weaknesses,  then  steal 
virtual  flags  (data  strings). 


©  Send  data  strings 
to  Scorebot. 


DefCon 

continued  from  page  1 

bird’s-eye  view  of  how  new  — 
and  not  so  new  —  attacks  could 
be  launched  and  thwarted. 

Each  qualified  team  playing 
the  game  —  organized  by  a 
Seattle  security  community 
group  called  the  Ghetto  Hackers 
—  controlled  a  pair  ofWindows 
machines  running  a  variety  of 
network  and  Web-based  services 
that  were  connected  to  each 
other  and  a  central  scoring 
mechanism  called  the  Scorebot 
via  a  Gigabit  Ethernet  network 
(see  graphic).  Rest  assured,  this 
hacker  network  was  not  connect¬ 
ed  to  the  Internet. 

As  soon  as  the  doors  to  the 
secluded  hacker  playground  dis¬ 
guised  as  a  hotel  ballroom  were 
opened  at  10  a.m.July  30,  the  air 
was  tense  in  this  crowded  room. 
The  game  scenario  and  the  legiti¬ 
mately  purchased  Windows  im¬ 
ages  were  presented  to  partici¬ 
pants  two  hours  before  the  offi¬ 
cial  noon  start  time.  How  would 
you  like  to  have  to  lock  down 
two  Windows  boxes  in  just  two 
hours  as  you  started  to  recognize 
that  there  were  world-class  ex¬ 
ploit  developers  in  the  room  — 
and  on  your  network? 

A  team  scored  by  attacking 
rivals’ servers  and  stealing  flags 
(data  strings  stored  within  the 
servers). The  successful  hacker 
then  presented  the  stolen  flags  to 
the  scoring  system  for  credit.The 
overall  score  was  a  combination 
of  credit  for  attacking  other 
teams’ servers  and  successfully 
defending  your  own  services. 
Penalties  were  issued  for  exces¬ 
sive  consumption  of  bandwidth, 
so  simple  port  scans  and  brute 
force  attacks  were  not  used,  and 
denial-of-service  attacks  were 
forbidden. 

In  the  middle  of  the  room  sat 
the  Ghetto  Hackers’  gear,  neces¬ 
sary  for  keeping  the  game  within 
bounds  and  blasting  loud  techno 
music  for  the  entire  36-hour  ride. 
We’d  trained  for  the  competition 
in  small  conference  rooms  with 
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similar  tunes  blaring  as  white 
noise  to  desensitize.  But  by  the 
time  it  was  2  a.m.,and  you  were 
staring  at  a  network  trace  flying 
by  on  a  screen, you  noticed  that 
your  heartbeat  and  your  breath¬ 
ing  synchronized  with  the  music 
and  the  packet  traffic.  At  that 
point,  it  was  time  to  take  a  walk. 

At  the  beginning  everyone  was 
organized  with  their  supplies. 

Our  cooler  was  stocked  with  ice 
and  Coke.  As  time  dragged  on, 
people  started  bringing  in  food 
and  drinks.  At  first  we  were  orga¬ 
nized  and  sent  out  someone  for 
bread  and  cold  cuts.  But  by  the 
middle  of  Day  Two  we  gave  up 
and  started  ordering  pizza. We 
stuck  with  soda  for  the  most  part, 
but  as  the  contest  wore  on,  a 
beer  or  two  appeared.  As  we 
scanned  the  room  (discreetly  of 
course)  we  saw  the  other  teams 
behaving  the  same  way  if  not 
more  so.  One  team  had  a  steadily 
draining  bottle  of  Southern 
Comfort  on  top  of  its  server. 

The  Ghetto  Hackers’  full-length 
equipment  rack  was  ornamented 
by  a  large,  red,  wooden  arch  in 
the  style  of  a  Japanese  archway 
complete  with  Asian  script.  Our 
Japanese  language  expert  slunk 
over  for  a  closer  look  and  deter¬ 
mined  the  writing  on  the  wall  to 
be  complete  gibberish,  with  no 
hidden  message  to  help  us  crack 
the  code. 

Each  team  carefully  arranged 
its  equipment  —  everything  from 
laptop  Macs  to  Cisco  switches, 
some  piled  3  feet  high  on  the 
allotted  two  tables  —  around  the 


periphery  of  the  room. Teams 
were  supposed  to  have  a  maxi¬ 
mum  of  15  members,  but  no  one 
stuck  to  that  upper  limit  as  the 
flow  in  and  out  of  the  room  easi¬ 
ly  boosted  each  roster  to  more 
than  20  people. 

The  ground  rules  I  agreed  to 
dictate  that  1  not  divulge  individ¬ 
uals’  identities.  But  in  general 
terms  I  can  say  the  teams  includ¬ 
ed  at  least  two  CTOs;  security 
professionals  from  Ernst  &Young, 
AOL  and  the  University  of 
California  at  Santa  Barbara;  and 
well-known  and  unknown  hack¬ 
ers.  Additionally  at  least  four 
teams  had  members  hailing  from 
the  U.S.  Department  of  Defense. 

We  mostly  kept  to  ourselves 
and  minimized  visible  screen 
space  to  avoid  becoming  vulner¬ 
able  to  “shoulder  surfing”  or  other 
forms  of  spying. 

You  also  had  to  do  some  recon¬ 
naissance  to  sniff  out  any  secret 
deals  being  cut  to  share  or  trade 
information  among  teams.Think 
“Survivor,”  when  it  was  good. 

There  wasn’t  exactly  a  book  on 
how  to  organize  your  team  or  set 
strategy  for  this  sort  of  thing.  But 
our  winning  strategy  as  a  team 
was  organization.  We  organized 
everything  from  a  rotating  “cat 
nap” schedule  to  divvying  up 
jobs  along  lines  of  expertise. 

Because  offense  was  80%  of  the 
overall  score, you  had  to  main¬ 
tain  support  for  your  front-line 
attackers.The  trick  was  to  not 
ignore  your  defenses.  If  your  de¬ 
fenses  slipped,  other  teams  could 
get  in  and  score.  As  the  Ghetto 


Hackers  pointed  out  at  the 
awards  ceremony  we  were  solid 
attackers  —  not  significantly  bet¬ 
ter  than  other  teams  —  but  we 
had  very  good  defense  and  were 
able  to  keep  other  teams  from 
stealing  flags  from  us. 

Most  attacks  we  saw  were 
levied  against  information  in  the 
database.  Someone  would  figure 
out  how  to  run  the  WIKI  (a 
piece  of  server  software  that  lets 
users  freely  create  and  edit  Web 
page  content  using  any  Web 
browser)  and  do  some  obscure 
set  of  queries  that  would  reveal 
flag  data.  Or  someone  would  go 
into  the  Multi-User  Dungeon, 
online  game  environments  that 
use  a  great  deal  of  bandwidth, 
and  figure  out  if  you  walked 
north  through  the  forest  just  the 
right  way  you’d  be  able  to  pick 
up  a  flag. 

We  saw  many  failed  attacks. 
Someone  tried  to  buffer  overflow 
the  Web  server  with  800,000-byte 
null  packets.  Someone  else  tried 
to  go  after  SNMP  services  to  gain 
entry. Teams  even  attempted  to 
capture  their  incoming  Scorebot 
traffic  and  replay  that  same  traf¬ 
fic  in  the  direction  of  our  mach¬ 
ines  in  the  hopes  that  our  ser¬ 
vices  would  mistake  them  for  the 
actual  Scorebot  and  give  up  flags 
to  them. 

If  I  were  to  apply  my  experi¬ 
ences  to  a  more  everyday  situa¬ 
tion  than  what  was  taking  place 
at  the  off-the-strip  Alexis  Park 
hotel,  five  points  would  bubble  to 
the  top  of  the  security  cauldron: 

•  Unsecure,  unnecessary  ser¬ 


vices  —  such  as  terminal  ser¬ 
vices  and  SNMP  —  are  running 
on  most  Windows  machines. 
You’ve  got  to  take  care  to  shut 
down  or  firewall  all  unnecessary 
ports  used  by  these  services. 

•  Passwords  are  revealed  fre¬ 
quently  To  defend  against  this, 
periodically  change  all  pass¬ 
words,  including  those  that  give 
access  to  Web  services  and  data¬ 
bases. 

•  Customized  Web  applications 
typically  leak  critical  informa- 
tion.To  defend  against  this,  appli¬ 
cations  must  be  modified  so  they 
do  not  have  commands  that  give 
too  much  information  without 
proper  authorization  or  let  users 
modify  objects  out  of  turn. 

•  Unmonitored  services  are 
dangerously  open  to  attack. 
Watch  your  logs  like  a  hawk. 

•  Hack  attacks  happen.  Be  very 
very  afraid. 

Thayer  is  principal  investigator 
with  Canola  &  Jones ,  a  security 
research  firm  in  Mountain  View, 
Calif.  He  can  be  reached  at  rod- 
ney@canola-jones.  com. 
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Oracle  lax 
in  response 
to  security 
flaws 

■  BY  JAMES  NICCOLAI 

Oracle  has  acknowledged  the 
existence  of  security  holes  in  its 
database  software  and  said  it 
plans  to  issue  a  security  alert 
soon.  The  U.K.  security  expert 
who  found  the  holes  criticized 
Oracle’s  conduct,  saying  the 
company  has  sat  on  patches  for 
about  two  months  that  would  fix 
the  holes. 

David  Litchfield,  managing  di¬ 
rector  of  Next  Generation  Secur¬ 
ity  Software,  says  he  has  found 
34  security  vulnerabilities  in 
past  and  current  versions  of 
Oracle’s  database  software,  at 
least  one  of  which  could  let  a 
hacker  gain  control  of  a  compa¬ 
ny’s  database  remotely  without 
a  password. 

Litchfield  says  he  notified 
Oracle  of  the  vulnerabilities  in 
January  and  says  the  company 
told  him  two  months  ago  that 
it  had  prepared  patches  to  repair 
them.  However,  Oracle  has  not 
released  the  patches  because  it 
is  in  the  midst  of  introducing  a 
new  system  for  distributing  secu¬ 
rity  fixes  to  customers,  he  says. 

“The  way  they  should  do  it  is 
to  run  the  old  system  [for  issu¬ 
ing  patches]  until  the  new  sys¬ 
tem  is  ready  for  use,”  he  says. 

Two  weeks  ago,  Litchfield  men¬ 
tioned  the  vulnerabilities  in  a 
presentation  at  the  Black  Hat 
computer  security  conference 
in  Las  Vegas.  They  were  first 
reported  last  week  by  The  Wall 
Street  Journal. 

Oracle  initially  would  not  con¬ 
firm  or  deny  the  vulnerabilities, 
saying  only  that  it  takes  security 
matters  seriously.  Later  it  ap¬ 
peared  to  confirm  the  flaws  in  a 
brief  statement,  part  of  which 
says:  “Oracle  has  fixed  the  issues 
discussed  in  The  Wall  Street 
Journal  and  will  issue  a  Security 
Alert  soon.” 

“Any  time  there’s  this  many  vul¬ 
nerabilities,  I  am  concerned 
about  it,”  says  Brent  Siler,  director 
of  IT  for  EXP  Pharmaceutical 
Services  in  Fremont,  Calif. 

“Luckily  for  us,  we  do  have 
intrusion-detection  systems  that 
we’ve  been  able  to  go  out  and 
modify”  he  says. 

Niccolai  is  a  correspondent 
with  IDG  News  Service. 
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Mobile  malware 


Malicious  programs  targeting  mobile  devices  in  the  past  two  months  include: 


Name: 

Alias/aliases 

Description 

Reported 

Brador 

Backdoor.WinCE. 

Brador.a 

A  backdoor  that  lets  hackers  take  control  of  PDAs.  It 
can  infect  Pocket  PC  devices  running  Windows  CE  4.2 
and  later,  and  newer  versions  of  Windows  Mobile. 

Aug.  5 

Duts 

WinCE/Duts, 
WinCE.Dust,  Dtus 

Proof-of-concept  virus  for  the  Pocket  PC  platform.  It  can 
infect  devices  running  Pocket  PC  2000, 2002,  2003. 

July  17 

Cabir 

SymbOS/Cabir.A, 

EPOC/Cabir.A 

A  worm  capable  of  spreading  via  Bluetooth.  It  can  infect 
mobile  phones  running  Symbian  OS. 

June  14 

PDAs 

continued  from  page  1 

devices.  Backdoor.WinCE.Brad- 
or.a  is  a  backdoor  utility  that, secu¬ 
rity  vendor  F-Secure  says,  “copies 
itself  to  the  startup  folder,  mails 
the  IP  address  of  the  PDA  to  the 
backdoor  author  and  starts  listen¬ 
ing  to  commands  on  a  TCP  port. 
The  hacker  can  then  connect 
back  to  the  PDA  via  a  TCP  port 
and  control  the  PDA  through  the 
backdoor”  (see  “How  Brador 
Works, ’’below). It  can  infect  Pocket 
PC  devices  running  Windows  CE 
Version  4.2  and  later,  and  newer 
versions  of  Windows  Mobile. 

The  discovery  of  the  Brador 
Trojan  horse  comes  less  than 
three  weeks  after  security  experts 
identified  Duts,  the  first  proof-of- 
concept  virus  to  target  the  Pocket 
PC  platform;  and  not  quite  two 
months  after  the  discovery  of 
Cabir,  a  proof-of-concept  worm 
that  spreads  via  Bluetooth.  Duts 
can  infect  devices  running  Pocket 
PC  2000,  Pocket  PC  2002  and 
Pocket  PC  2003.  Cabir  can  infect 
Bluetooth  phones  running  the 
Symbian  OS. 

“We  were  certain  that  a  viable 
malicious  program  for  PDAs 
would  appear  soon  after  the  first 
proof-of-concept  viruses  emerged 
for  mobile  phones  and  Windows 
Mobile,”  Eugene  Kaspersky  head 
of  anti-virus  research  at  Kasper¬ 
sky  Labs, said  in  a  statement. 

Whereas  Duts  and  Cabir  are 
conceptual  viruses  that  contain 
no  payload,  Brador  is  a  fully  func¬ 
tional  Trojan  horse  with  the  com¬ 
plete  range  of  destructive  func¬ 
tions  typical  of  other  backdoors, 
according  to  Kaspersky  Labs.  For 
example,  the  program  can 
respond  to  commands  to  upload 
or  download  files. 

“Backdoor.WinCE.Brador.a  is 
most  probably  already  in  the 
wild,  and  it’s  absolutely  viable,” 
says  Alexey  Zernov,  a  spokesman 
for  Kaspersky  Labs.  “This  back¬ 
door  wasn’t  written  for  demon¬ 
stration  but  for  a  specified  pur¬ 
pose:  to  penetrate  PDAs,  getting 
full  control  of  the  infected  mobile 
device.” 

A  group  called  29A  is  responsi¬ 
ble  for  creating  Duts  and  Cabir.Ac- 
cording  to  Kaspersky  Labs,  a  Rus¬ 
sian  malicious  code  writer  creat¬ 
ed  Brador  with  the  text:  “Get  to 
work,  folks,  the  Pocket  PC  market 
will  soon  explode.” 

Once  in  the  wild,  Brador  could 
prey  upon  the  growing  numbers 
of  wireless-enabled  handheld  de¬ 
vices  corporations  are  deploying 
to  run  IP  services,  connect  to  the 
Web  and  provide  remote  access 
to  corporate  network  resources. 


But  exactly  how  damaging  such 
attacks  could  be  is  debatable. 

Symantec  categorizes  Brador  as 
a  Level  1  threat  in  a  range  from  1 
to  5,  with  5  being  the  most  severe. 

The  threat  of  vandalism  and  in¬ 
formation  leakage  exists,  but  a 
compromised  cell  phone  isn’t 
likely  to  knock  over  an  entire  cor¬ 
porate  network,  says  Rodney 
Thayer,  a  private  network  security 
consultant  at  Canola  &  Jones  and 
a  Network  World  Lab  Alliance 
member.  “I’m  not  sure  1  would 
have  put  it  at  Level  1 ,  but  I  would¬ 
n’t  be  running  around  crying  we 
have  an  immediate,  incredible 
crisis  either’’ 

Data  access  is  a  concern,  says 
Joel  Snyder,  a  senior  partner  at 
consulting  firm  Opus  One  and  a 
member  of  the  Network  World 
Lab  Alliance.  When  users  access 
corporate  resources  over  the  In¬ 
ternet  via  a  mobile  device,  it’s  im¬ 
portant  that  IT  managers  restrict 
their  network  access,  Snyder  says. 

Offsetting  the  threat  to  mobile 
devices  is  the  fact  that  they’re  not 
continuously  connected  to  the 
Internet.  Rather,  users  tend  to  con¬ 
nect  for  a  few  minutes  every  few 
hours,  which  makes  them  less 
attractive  to  Trojan  horse  writers 


than  broadband-connected  PCs, 
for  example,  Snyder  says. 

But  that  could  change.“ln  two  or 
three  years,  when  power  require¬ 
ments  for  wireless  LANs  are  re¬ 
solved,  we  may  well  see  someone 
with  a  Pocket  PC-sized  machine 
that’s  wirelessly  connected  all 
day  long,”  Snyder  says.  Securing 
mobile  devices  is  going  to  be¬ 
come  a  bigger  issue  as  they  be¬ 
come  more  connected,  he  says. 

Mobile  devices  are  vulnerable 
to  attack  for  multiple  reasons, 
Snyder  says. 

For  one,  handheld  devices  don’t 
have  a  lot  of  computational  re¬ 
sources  to  process  or  capacity  to 
store  security  features.  “Adding  a 
lot  of  password  screens  and  auth¬ 
entication  stuff  might  require 
resources  that  are  just  not  avail¬ 
able  in  those  devices,”  he  says. 

So  companies  tend  to  forego 
really  strong  authentication  sys¬ 
tems,  such  as  digital  certificates, 
because  of  the  computational 
burden. 

Mobile  device  developers  also 
aren’t  accustomed  to  stringent 
security  requirements,  Snyder 
says.“It’s  not  part  of  their  mindset 
because  they  never  lived  in  this 
hostile  environment.” 


On  the  plus  side,  the  growing 
number  of  attacks  is  putting 
emphasis  on  the  need  to  pay 
more  attention  to  mobile  devices. 

Creating  and  enforcing  usage 
policies  is  critical. A  little  more  vig¬ 
ilance  is  warranted, Thayer  says. 

The  problem  is,  users  perceive 
mobile  devices  as  their  own  and 
download  with  abandon.  “It’s  go¬ 
ing  to  be  an  uphill  battle  for  IT 
managers,  just  because  of  the  nat¬ 
ure  of  the  devices,”  Snyder  says. 

Users  are  watching  the  develop¬ 
ments  carefully 

“Given  that  the  majority  of  CE 
devices  in  production  currently 
are  not  network  connected,  [any] 
exploit  will  hopefully  be  mini¬ 
mal, ’’says  Christopher  Misra,a  net¬ 
work  analyst  at  the  University  of 
Massachusetts.  “However  given 
the  trend  toward  network  con¬ 
nection  for  handhelds,  and 
increased  wireless  coverage,  this 
may  become  more  serious.” 

At  Ozburn-Hessey  Logistics,  the 
majority  of  handheld  devices  in 
use  at  the  Nashville  company 
contain  only  personal  data.  A  few 
employees  might  store  spread¬ 
sheet  files  containing  corporate 
information,  says  Matthew  Booh- 
er,  director  of  IS  at  Ozburn-Hessey 
Also,  the  PDAs  are  not  wireless- 
enabled,  except  for  a  handful  of 
BlackBerry  devices.  The  Black- 
Berries,  which  can  be  used  to 
access  e-mail  wirelessly“could  be 
a  real  problem”if  a  PalmOS  Trojan 
were  to  surface,  Booher  says. 

Preventing  PDAs  and  PCs  from 
transferring  viruses  to  each  other 
via  the  direct  synchronization  link 
could  be  a  job  for  anti-virus  soft¬ 
ware,  Booher  says.  “My  thought 
would  be  to  have  the  PC  anti-virus 
program  be  smart  enough  to  look 
for  the  virus  on  the  PC  and  block 
it  before  it  got  to  the  handheld. 
Obviously,  wireless  connections 
would  be  a  different  matter” 

Senior  Editor  John  Cox  con¬ 
tributed  to  this  story. 
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Brador  is  a  classic  Trojan  backdoor  program  that  opens 
an  infected  machine  for  remote  administration,  accord¬ 
ing  to  Kaspersky  Labs.  It  cannot  spread  by  itself;  it 
launches  if  a  user  opens  an  e-mail  attachment  in  which  it’s 
embedded,  downloads  it  from  the  Internet  or  uploads  it. 

Once  launched,  the  5,632-byte  program  creates  an 
svchost.exe  file  in  the  Windows  autorun  folder,  which  lets  it 
assume  full  control  over  the  system  every  time  the  handheld 
is  turned  on.  Brador  identifies  the  machine's  IP  address  and 
sends  it  to  the  author,  verifying  that  the  handheld  is  on  the 
Internet  and  the  backdoor  is  active.  Brador  then  opens  Port 
44299  and  awaits  further  commands. 

The  open  port  gives  the  author  full  control  over  the  infected 
PDA.  Brador  is  programmed  to  upload  and  download  files  and 
execute  a  series  of  other  commands. 

—  Ann  Bednarz 
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Venture  funding  chases  tried  and  true 


Dollars  deja-vu 

Some  of  the  largest  investments  in  network-related  companies  during  the  second 
quarter  went  to  firms  working  to  improve  established  technologies. 


Company 

Product 

Investment 

amount 

Major  investors 

ForcelO  Networks 

High-speed  Internet  switches 

$75  million 

WorldviewTechnology,  Meritech 
Capital,  MorgenthalerVentures,  NEA 

Mahi  Networks 

Optical  networks 

$70  million 

Oak  Investment,  Rho  Ventures,  JVP 

Spreadtrum 

Communications 

Wireless  integrated  circuits 
and  software 

$35  million 

NEA,  Vertex  Management,  Pacific 
Venture 

Calix 

Fiber-optic  platforms 

$30  million 

Redpoint  Ventures,  Kinetic  Ventures 

SOURCE;  THE  MONEY  TREE  SURVEY,  CONDUCTED  BY  PR  ICE  WATERHOUSE  COOPERS.  THOMSON  VENTURE  ECONOMICS  AND  THE  NATIONAL  VENTURE  CAPITAL 
ASSOCIATION. 


£  BY  CARA  GARRETSON 

In  deciding  where  to  put  their 
money  these  days,  venture  capi¬ 
talists  appear  to  have  given  up 
looking  for  the  “new,  new  thing,” 
at  least  temporarily,  and  instead 
are  investing  in  companies  that 
are  trying  to  improve  existing 
technologies. 

According  to  a  special  quar¬ 
terly  MoneyTree  Sur¬ 
vey  created  for 
Network  World, 

investors  poured 

$2.6  billion  into  net¬ 
work-related  compa¬ 
nies  during  the  sec¬ 
ond  quarter,  up  from 
$2.5  billion  during  the  first  quar¬ 
ter.  These  companies  include 
providers  of  computer  and  per¬ 
ipheral  products,  IT  services,  net¬ 
work  gear  and  software,  as  well 
as  semiconductors.  The  Money- 
Tree  Survey  is  conducted  by 
PricewaterhouseCoopers, 
Thomson  Venture  Economics 
and  the  National  Venture  Capital 
Association. 

Two  investments  made  during 
the  second  quarter  stood  out 
from  the  crowd;  Force  10  Net¬ 
works  raised  $75  million,  and 
Mahi  Networks  attracted  $70  mil¬ 
lion  (see  graphic).Yet  neither  the 
companies  nor  the  products  they 
develop  fall  into  new  categories; 
5-year-old  Force  10  Networks  sells 
Internet  switches,  and  Mahi 
Networks,  also  founded  in  1999, 
makes  optical  network  systems. 

“That’s  pretty  mainstream  stuff,” 
says  Tracy  Lefteroff,  global  man¬ 
aging  partner  of  Venture  Capital  & 
Private  Equity  Practice  at 
PricewaterhouseCoopers.  Most  of 
the  network  companies  that 
received  investments  this  past 
quarter  are  focused  on  “improv¬ 
ing  existing  technology  to  make  it 
better,  faster,  cheaper’’  he  says. 

Despite  this  focus  on  estab¬ 
lished  companies,  about  one- 
third  of  second-quarter  invest¬ 
ments  went  to  early-stage  compa¬ 
nies, defined  as  those  with  a  prod¬ 
uct  in  the  test  phase,  according  to 
the  survey 

Of  the  395  networking-related 
deals  signed  this  quarter,  120 
were  with  early-stage  compa¬ 
nies  This  is  roughly  on  par  with 
first-quarter  investments,  when 
97  of  the  360  investments  were 
made  in  early-stage  companies. 

Topping  early-stage  deals  for 
the  second  quarter  were  a  pair 
of  $15  million  investments,  one 
in  SiNett  and  the  other  in  Tzero. 


Both  companies  are  new  and 
are  in  the  same  product  catego¬ 
ry:  developing  silicon  technolo¬ 
gies  for  use  in  wireless  networks 
and  devices. 

“We’re  seeing  a  lot  of  the  same 
types  of  investments  in  the  IT 
space.  We  haven’t  really  seen  any 
truly  disruptive  technologies  out 
there,”  Lefteroff  says. 

As  investors  focus  more  on 
companies  with 
tried-and-true  tech¬ 
nologies  and  less 
on  the  bleeding 
edge,  they  are 
investing  and  rein¬ 
vesting  in  fewer 
companies,  but 
ones  that  they  see  having  greater 
chances  for  success,  says  Gary 
Morgenthaler,  general  partner 
with  Morgenthaler  Ventures, 
which  was  one  of  the  leaders  in 
Force  10  Networks’  second-quar¬ 


ter  investment. 

This  change  of  focus  is  notable 
from  the  late  ’90s  style  of  invest¬ 
ing,  when  investors  scrambled  to 
have  at  least  one  company  rep¬ 
resenting  every  type  of  new 
technology  in  their  portfolios, 


he  says. 

“When  you  have  25  or  30  or 
more  competitors,  as  you  did 
with  the  metropolitan  broad¬ 
band  companies  two  or  three 
years  ago  .  .  .  too  many  compa¬ 
nies  fight  tooth  and  nail  for  what 


business  there  is,  and  ultimately 
no  one  makes  any  money” 
Morgenthaler  says.  “Having  a 
narrow  range  of  choice  of 
healthier  companies  with  less 
competition  is,  in  fact,  what  the 
market  wants  in  the  long  term.”* 


Qwest  latest  carrier  with  enterprise  woes 

Analysts  say  rising  competition  and  lower  prices  are  to  blame. 


BY  JIM  DUFFY 


Deep  discounts 


Add  Qwest  to  the  list  of 
carriers  bludgeoned  by 
the  enterprise  network  ser¬ 
vices  market. 

The  RBOC/interex- 
change  carrier  (IXC)  last 
week  reported  disappoint¬ 
ing  second-quarter  finan¬ 
cial  results  in  large  part 
because  of  cutthroat  com¬ 
petition  in  the  enterprise 
market.  Qwest  cited 
intense  pricing  pressure  in 
selling  voice  and  data  ser¬ 
vices  to  corporations,  the 
same  concerns  AT&T  and 
MCI  had  voiced  in  their 
quarterly  earnings  reports. 

“When  the  competition 
says,  ‘I’ll  do  this  price  or 
that  price’ we’ll  walk  away’ 
said  Qwest  CEO  Dick 
Notebaert  during  a  confer¬ 
ence  call  with  financial 
analysts  last  week.  He  characterized  the  com¬ 
petition  in  the  enterprise  market  as  “brutal." 

Qwest  posted  a  loss  of  $776  million  for  the 
second  quarter  ended  June  30,  significantly 
worse  than  the  $64  million  loss  posted  in  last 
year’s  second  quarter.  Revenue,  at  $3.4  billion, 
fell  4%  vs.  the  year-ago  quarter. 

Analysts  agree  with  Notebaert’s  assessment 
of  the  enterprise  telecom  market. 

“One  of  the  big  problems  these  guys  are  fac¬ 
ing  is  that  they’re  seeing  some  demand 


Qwest,  like  other 
carriers,  is  finding  it 
increasingly  difficult  to 
make  money  in  light  of 
falling  prices  for  wire¬ 
line  enterprise  telecom 
services. 

Year-over-year 
%  change  in  pricing 
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%  -11.696 


-12% 

-14% 


‘Forecast 

SOURCE  LEHMAN  BROS 


increases,  some  volume 
increases,  but  in  many 
cases  it’s  not  enough  to 
offset  the  price  compres¬ 
sion,”  says  David  Parks,  an 
analyst  at  The  Yankee 
Group. 

According  to  Lehman 
Brothers,  prices  of  com¬ 
mercial  telecom  services 
have  been  dropping  in 
the  double-digit  percent¬ 
ages  for  the  past  two  years 
(see  graphic). 

At  the  same  time,  com¬ 
petition  has  intensified. 
RBOCs  with  approval  to 
offer  long-distance  have 
built  out  nationwide  IP 
networks  to  go  after  the 
enterprise  data  business 
that  the  IXCs  once 
owned. 

Meanwhile,  the  IXCs  are 
focusing  more  intently  on 
the  enterprise  market  as 
they  retreat  from  consumer  and  residential 
telecom  after  recent  rulings  by  regulators  on 
wholesale  access  policies.  Earlier  this  year, 
AT&T  CEO  David  Dorman  pledged  that  the 
carrier  “will  not  be  beat  on  price”  in  the  enter¬ 
prise  market  in  order  that  it  can  maintain  and 
grow  market  share. 

Sprint  also  has  pledged  to  keep  enterprise 
prices  low,  and  MCI  eliminated  much  of  its 
debt  during  Chapter  1 1  bankruptcy  reorgani¬ 
zation  so  the  carrier  can  afford  to  be  more 


aggressive  on  price. 

“These  guys  are  all  going  after  the  same  pie 
right  now,  and  although  the  pie  is  getting  a  lit¬ 
tle  bigger  it’s  not  growing  at  the  same  rate  as 
the  level  of  competition,”  Parks  says. 

Qwest,  meanwhile,  was  an  IXC  before  it  was 
an  RBOC.  The  carrier  already  had  a  national 
OC-192  optical  fiber  backbone  in  place  before 
acquiring  RBOC  US  West  five  years  ago. 

Some  analysts  on  last  week’s  conference  call 
inquired  whether  Qwest  might  seek  strategic 
alternatives  for  its  national,  backbone,  such  as 
selling  it  off  and  leasing  back  capacity,  to 
relieve  some  of  the  costs  associated  with  own¬ 
ing  and  operating  it.  Reducing  such  costs 
might  make  Qwest  better  able  to  compete  on 
price  in  the  enterprise  market. 

Notebaert  said  that  option  was  not  currently 
a  high  priority  for  the  carrier.  A  better  option, he 
said,  was  to  make  the  “on-  and  off-ramps’’to  the 
fiber-optic  backbone  more  efficient  —  and 
less  costly  —  so  that  Qwest  can  attain  break¬ 
even  results  on  enterprise  cash  flow. 

“When  we  get  to  the  December  quarter  — 
March  quarter  at  the  latest  —  and  we’re  run¬ 
ning  break-even,  that  [backbone]  is  not  a  bad 
asset,”  he  said. 

The  Yankee  Group’s  Parks  agrees:  “It’s  a  criti¬ 
cal  component  of  the  business  and  a  pretty 
important  capability  for  them.  1  don’t  think 
[divesting  it]  would  make  sense  at  this  time.”B 
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Introducing  DuPont™  certified  limited  combustible  cable.  In  the  event  of  a  fire,  securing  your 
business’  uptime  is  crucial.  The  data  communications  cable  you  choose  could  play  a  key  role  in  protecting 
your  network  technology  investment.  DuPont,M  certified  cable  produces  20  times  less  smoke  than  other 
plenum  rated  cables.  And  less  smoke  means  less  costly  downtime,  making  it  the  most  advanced  fire 
safety  cable  technology  available  today.  To  learn  more  about  DuPont  '  certified  limited  combustible  cable 
or  to  request  a  free  CD,  log  on  to  teflon.com/cablingmaterials  or  call  1-800-207-0756. 


The  miracles  of  science' 


16 

NetworkWorld 

8/9/04 

News 

www.nwfusion.com 

What  the  doctor  ordered 

Several  efforts  are  underway  to  cure  hospitals’  software 

patching  ills. 

•  North  American,  European  and  Japanese  medical-device 
manufacturers,  under  the  auspices  of  the  National  Electrical 
Manufacturers  Association's  Joint  Privacy  and  Security 
Committee  for  International  Medical  Informatics,  plan  to  issue 
a  document  this  fall  called  “Patching  Off-the-Shelf  Software 
Used  in  Medical  Information  Systems”  to  specify  a  standard  to 
protect  medical  equipment. 

•  The  Air  Force  is  requiring  medical-device  manufacturers  to  submit 
their  equipment  for  evaluation  and  adherence  to  software-patch 
guidelines  to  earn  its  “Certificate  of  Networthiness." 

•  The  Department  of  Veterans  Affairs  has  issued  a  “Medical  Device 
Isolation  Architecture  Guide"  for  protecting  medical  devices  in 
VA  hospitals  and  this  week  plans  to  announce  that  an  IPSecVPN 
will  be  used  in  the  patch-update  process. 


Patches 

continued  from  page  1 

Angry  hospital  IT  executives 
who  say  they  can’t  ignore 
the  risks  from  computer  worms 
and  hackers  getting  into  un¬ 
patched  Windows-based  devices 
are  taking  matters  into  their  own 
hands  by  applying  the  patches 
themselves. 

“When  Microsoft  recommends 
we  apply  a  critical  patch,  the  ven¬ 
dors  have  come  back  and  said 
‘We  won’t  support  you,’”  says 
Dave  McClain,  information  sys¬ 
tems  security  manager  at  Com¬ 
munity  Health  Network  in 
Indianapolis. 

So  the  hospital  has  gone  ahead 
and  applied  critical  Microsoft 
patches  to  vulnerable  patient- 
care  systems  when  vendors 
wouldn’t,  McClain  says.The  hospi¬ 
tal  views  the  failure  to  apply 
patches  as  a  possible  violation  of 
the  federal  Health  Insurance 
Fbrtability  and  Accountability  Act 
(HlPAA).“We  have  HIPAA  regula¬ 
tory  issues,  and  you  can’t  hold  us 
back  from  compliance,”  he  says. 

Other  hospitals  make  the  same 
contentions. 

The  North  Carolina  Healthcare 
Information  and  Communica¬ 
tions  Alliance  (NCHICA),  a  250- 
member  technology  advocacy 
group  for  regional  hospitals,  clin¬ 
ics,  pharmacies  and  legal  firms, 
earlier  this  year  sent  a  letter  to  the 
FDAs  enforcement  division  ask¬ 
ing  the  FDA  to  provide  “more 
guidance”  on  patching. The  prob¬ 
lem,  NCHICA  wrote,  is  that  “secur¬ 
ity  flaws  can  result  in  systems  that 
do  not  function  as  intended 
and/or  allow  unauthorized  modi¬ 
fication  to  data.  Systems  compro¬ 
mised  in  these  ways  may  repre¬ 
sent  a  significant  risk  to  patient 
safety’ 

“Security  of  the  systems  is  the 
primary  focus  of  the  letter;”  says 
Holt  Anderson,  executive  director 
of  NCHICA. Without  the  operating 
systems  properly  maintained  in 
terms  of  patching, “there  is  no  way 
to  secure  devices  that  are  con¬ 
nected  to  a  LAN  or  wireless  facil¬ 
ity  he  says. 

The  FDAs  Murray  says  the  med¬ 
ical  industry'  faces  a  serious  prob¬ 
lem  because  the  “quality  of  some 
of  these  off-the-shelf  software 


products  is  on  the  low  side,” allud¬ 
ing  to  the  perennial  stream  of 
security  notifications  from  Micro¬ 
soft  and  other  software  vendors. 

He  adds  that  when  the  FDA 
eight  years  ago  began  allowing 
off-the-shelf  software  in  medical 
devices,  it  didn’t  foresee  the 
kinds  of  security  issues,  such  as 
computer  worms,  that  plague 
networks. 

The  FDA  doesn’t  have  a  com¬ 
prehensive  response  to  the  prob¬ 
lem.  “But  we’re  not  going  to  go 
back  to  a  time  of  non-networked 
medical  devices  that  used  to  be 
stand-alone,”  Murray  says. 

The  problem  is  that  computer 
worms  that  target  Microsoft- 
based  computers,  including  MS- 
B1  aster  and  Sasser,  have  increas¬ 
ingly  struck  hospital  networks, 
where  unpatched  Windows- 
based  patient-care  systems  have 
become  infected. Some  manufac¬ 
turers,  including  Philips,  contend 
that  hospitals  must  do  a  better  job 
of  applying  security  defenses  to 
protect  medical  devices  by  buy¬ 
ing  intrusion-prevention  systems 
(IPS)  and  internal  firewalls. 

However,  hospital  IT  profession¬ 
als  respond  that  it’s  not  that 
unusual  for  medical-device  man¬ 
ufacturers  to  be  the  origin  of 
worms  that  get  in  their  networks. 

There  have  been  several  in¬ 
stances  in  which  viruses  originat¬ 
ed  from  medical  instruments 
straight  from  the  vendors, says  Bill 
Bailey,  enterprise  architect  at 
ProHealth  Care,  a  Milwaukee 


healthcare  provider.  Medical 
equipment  arrived  with  com¬ 
puter  viruses  on  it  or  service  tech¬ 
nicians  introduced  the  viruses 
while  maintaining  the  equip¬ 
ment,  he  says. 

Bailey  says  he  wants  device 
manufacturers  to  consider  in¬ 
cluding  host-based  IPSs  on  Win¬ 
dows-based  patient  systems.  In 
addition,  he  would  like  to  see 
Microsoft  involved  in  helping  tai¬ 
lor  its  operating  system  and  appli¬ 
cations  for  the  medical  industry 

“The  medical-device  manufac¬ 
turers  don’t  understand  the  sys¬ 
tems,  whether  Microsoft  or  Unix,” 
Bailey  says.“They  leave  them  in  an 
untouchable  state  for  a  long  time. 
The  idea  of  periodic  changes  is 
hard  for  them.” 

Although  Bailey  says  he’s  not  in 
favor  of  filing  complaints  with  the 
FDA,  which  could  escalate  into 
legal  conflict,  he  does  want  to  see 
the  FDA  apply  pressure  on  the 
manufacturers. 

The  FDA  shows  signs  of  doing 
just  that.  This  June  during  a  Web- 
based  conference  with  the  47- 
member  University  HealthSystem 
Consortium  to  discuss  the  issue 
of  security  patching,  the  FDAs 
deputy  director  in  the  medical- 
device  division  of  the  Office  of 
Science  and  Engineering  Labora¬ 
tories  urged  hospitals  to  file  com¬ 
plaints  about  medical  devices. 

“Deputy  Director  Brian  Fitz¬ 
gerald  said  if  you  have  a  vendor 
that  won’t  patch,  notify  us,”  says 
Joe  Bajek,  director  of  IT  at  the 
Health  Sciences  Center,  a  teach¬ 
ing  hospital  in  Denver.  The  FDA 
indicated  it  might  regard  patch¬ 
ing  failure  as  a  “product  aban¬ 
donment,”  which  might  mean 
yanking  vendor  certifications. 

Bajek  says  filing  a  complaint 
with  the  FDA  would  involve  inter¬ 
nal  discussions  with  his  com¬ 
pany’s  legal,  purchasing  and  bio¬ 


medical  groups  to  determine 
which  vendors  are  the  worst 
offenders.  But  he’s  open  to  the 
idea,  and  at  any  rate,  “we  can  say 
to  vendors,  if  you  don’t  have  a 
strategy  we’re  going  to  the  FDA.” 

Pressure  on  device  vendors  to 
patch  also  is  coming  from  the  U.S. 
Air  Force,  which  operates  78  hos¬ 
pitals.  While  the  Air  Force  can’t 
solve  the  patch  issue  single-hand¬ 
edly,  it  is  drawing  attention  to  the 
security  issues  by  not  allowing 
certain  medical  equipment  on 
the  Air  Force  network  unless  it’s 
patched.  Under  an  equipment 
evaluation  program  that  results  in 
a  vendor  earning  a  “Certificate  of 
Networthiness,”  the  Air  Force  has 
started  to  require  that  medical 
picture  archiving  systems  based 
on  Windows,  Sun  Solaris  and 
accompanying  databases  un¬ 
dergo  evaluation  based  on  tools 
from  the  Defense  Information 
Systems  Agency  and  vendors  that 
include  Internet  Security  Systems 
before  allowing  the  equipment 

fcfcWhen  Microsoft 
recommends  we 
apply  a  critical 
patch,  the  vendors 
have  come  back 
and  said  ‘We  won't 
support  you.' 9  9 

Dave  McClain 

Information  systems  secu¬ 
rity  manager,  Community 
Health  Network 


onto  the  Air  Force  network. 

“These  medical  images  are 
going  across  from  base  to  base, 
and  there’s  concern  about  secur¬ 
ity’ says  Tom  Lewis,  program  man¬ 
ager  of  medical  picture  archiving 
systems  at  the  Air  Force  Medical 
Support  Agency  at  Fort  Detrick, 
Md.  “This  is  the  same  network 
used  by  the  war  fighter”  The  Air 
Force  wants  to  ensure  that  med¬ 
ical  devices  don’t  become  the 
means  to  compromise  military 
operations  in  any  way 

The  Air  Force  medical-device 
evaluation  program  requires  ven¬ 
dor  technicians  updating  patches 
to  have  security  clearances  and 
requires  vendors  to  agree  to 
apply  patches  if  possible  after 
CERT  and  other  security  bulletins 
are  issued.  Still,  ultimately  there 
are  no  guarantees  because  soft¬ 
ware  updates  potentially  can 
break  medical  systems. 

“It’s  not  possible  to  make  a  guar¬ 


antee,”  says  Tim  Artz,  Agfa’s  global 
government  program  director, 
who  adds  that  he  has  not  yet  seen 
a  device  from  Agfa  that  couldn’t 
handle  a  security  patch. 

Agfa,  a  major  supplier  of  med¬ 
ical  picture  archiving  systems  to 
the  Air  Force,  last  month  became 
the  first  to  earn  the  equipment 
certification.  Other  vendors,  in¬ 
cluding  Eastman  Kodak’s  Health 
Imaging  Group,  also  plan  to  sub¬ 
mit  equipment  for  testing,  partic¬ 
ularly  because  it’s  a  requirement 
for  the  next  large  Air  Force  med¬ 
ical-equipment  contract. 

Artz  says  the  Certificate  of  Net- 
worthiness  program  helps  the  Air 
Force  unify  under  the  banner  of 
one  security  regimen  rather  than 
requiring  medical-device  testing 
at  each  base,  as  was  the  case 
before.  Artz  says  he  hopes  to  see 
similar  unified  programs  in  the 
Army  and  Navy 

The  U.S.  Department  of  Veterans 
Affairs  this  week  at  its  annual  IT 
Conference  in  Austin  is  expected 
to  detail  how  medical-device 
manufacturers  will  be  able  to 
more  securely  access  the  VA  net¬ 
work  to  perform  security  patches 
to  medical  equipment.  The  ap¬ 
proach  will  entail  use  of  a  Cisco- 
based  gateway-to-gateway  VPN 
using  two-factor  authentication 
by  means  of  RSA  Security’s 
SecurlD  token  hardware. 

The  medical-device  manufac¬ 
turers  emphasize  that  they  are  as 
eager  as  their  customers  to  re¬ 
solve  problems  associated  with 
patching. 

One  step  they  hope  to  take 
would  be  to  issue  industry  guide¬ 
lines  later  this  fall  under  the  aus¬ 
pices  of  the  National  Electrical 
Manufacturers  Association’s  Joint 
Privacy  and  Security  Committee 
for  Internatibnal  Medical  Infor¬ 
matics.  The  document,  now  in 
draft  form,  will  be  called  “Patch¬ 
ing  Off-the-Shelf  Software  Used  in 
Medical  Information  Systems.” 

James  Keese,  chief  privacy/ 
security  officer  at  Eastman  Ko¬ 
dak’s  Health  Imaging  Group,  says 
the  standards  document  will 
address  a  range  of  safety  issues  in 
patching  medical  devices.  But  the 
bottom-line  problem,  he  says,  is 
that  “patches  from  Microsoft  have 
had  an  impact  on  medical  appli¬ 
cations.” 

When  that  happens,  the  manu¬ 
facturer  is  left  in  the  situation 
where  the  medical  device  simply 
can’t  be  updated  with  a  security 
patch  because  this  might  cause 
the  device  to  malfunction  —  also 
a  threat  to  patient  safety  ■ 

Get  more  information  online. 
DocFinder:  3246 
www.nwfusion.com 


Previous  coverage 


&  hospitals  and  medical-device  manufacturers  clash  over 
how  to  apply  security  patches  to  Windows-based  patient-care 
systems.  See  www.nwfusion.com,  DocFinder:  3248. 
r.  Venders  and  customers,  including  the  U.S.  Department  of 
Veterans  Affairs,  look  for  solutions  to  medical-device  secur¬ 
ity  problems.  See  DocFinder:  3249. 
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Learn  How  to  Achieve 
Storage  Networking  Success 

•  Get  a  Contemporary  Overview  of  Today's  Storage  Networking  Issues  and  Opportunities 

•  See  How  to  Implement  and  Deploy  the  Latest  in  Storage  Networking  Technologies 

•  Hear  the  Latest  in  Enterprise  Security 

•  Learn  from  Best  Practices  and  Case  Studies 


"...  at  SNW,  you  connect  with 
folks  you  normally  wouldn’t 
meet  and  capitalize  on  the 
serendipitous  exchange 
of  ideas ...” 

a  John  Seely  Brown 

Former  Director,  Xerox 
Palo  Alto  Research  Center 
(PARC),  and  former  Chief 
Scientist,  Xerox 


Why  You  Should  Attend 

Are  you  responsible  for  managing  your  company's  storage  assets  and  strategies?  Want  to 
exchange  innovative  ideas  and  strategies  with  other  executives  who  share  the  same 
objectives?  Then  attend  Storage  Networking  World,  where  you'll  network  with  and  learn 
from  renowned  experts  and  the  nation’s  top  user  executives. 


Conference  At-a-Glance  (subject  to  change) 

For  details,  updates,  and  to  register  visit  www.snwusa.com/nww 

MONDAY,  OCTOBER  25 

9:00am  to  9:30am  Breakfast 


9:30am  to  10:25am 


INDUSTRY  PRIMER  TRACK 


Addressing  High 
Density  Cooling  of 
Storage  Networking 
Equipment  at  the 
Facility  Level 
Donald  Beaty,  Founder  & 
President,  DLB  Associates 


INDUSTRY  PRIMER  TRACK 


Storage  Basics 
and  Trends 

Dennis  Martin,  Senior  Analyst, 
and  Greg  Schulz,  Senior  Analyst, 
Evaluator  Group 


CAREER  DEVELOPMENT  TRACK 


Power  Statements, 
Questions  and 
Answers  Techniques 

Howard  Goldstein,  Founder, 
Howard  Goldstein  Associates,  Inc. 
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1 0:35am  to  1 1 :30am  Role  of  Server  Blades 

and  Virtualization  in  Next 
Generation  Data  Center 

Arun  Taneja,  Founder  and 
Consulting  Analyst,  Taneja  Group 


Why  Tape  Continues 
to  Make  the  Grade 

Richard  Harada,  President,  Tape 
Technology  Council 


1 1 :30am  to  1 :00pm  Luncheon 


Afternoon 


■  Data  Lifecycle 

■  Virtualization  & 
Securing  Your  Storage 

•  Focus  on  Networking 
Your  Storage 

•  Focus  on  Storage 

•  SAN  Management 

•  Voice  of  the  User 
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•  IDC 

In  this  fast-paced  session,  IDC's 
top  storage  analysts  will  examine 
companies'  growing  interest  in 
deploying  tiered  storage  solutions 
and  assess  its  impact  on  storage 
components,  systems,  networks, 
management  and  services. 


SPONSORED  BY 

Quantum 


The  pre- 
conference 
golf  outing 
at  the  Ritz-Carlton  Golf  Club  located 
adjacent  to  the  JW  Marriott  Grande 
Lakes  Resort  is  complimentary  (a 
$125  value)  for  registered  IT  end- 
users.  (Other  participants,  including 
sponsors  and  vendor  representatives, 
may  play  on  an  available"  basis 

and  are  responsi¬ 
ble  for  all  applica¬ 
ble  golf  outing 
expenses.) 


To  secure  your  spot, 
contact  Michael  Meleedy  at 
1-508-820-8529. 
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7:00pm  to  9:00pm  Welcome  Reception 
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For  more  information  and  to  register,  visit  www.snwusa.com/nww  or  call  1  -800-883-9090 


TUESDAY,  OCTOBER  26  General  Sessions  Begin 

7: 1 5am  to  8: 1 5am  Breakfast 


8:30am  to  9:15am 
9:15am  to  9:45am 
9:45am  to  10:15am 
10:30am  to  1 1 :00am 
1 1 :00am  to  1 1 :30am 


i: 


Don  Tapscott,  Renowned  Bestselling  Author  of  The  Naked  Corporation, 
Growing  Up  Digital  and  Paradigm  Shift 

The  Future  of  Knowledge  Management 

John  Halamka,  MD,  CIO,  CareGroup  Health  System  and  Harvard  Medical  School 


Kevin  Rollins,  President  &  COO,  Dell 


Keith  Glennan,  VP  &  CIO,  Northrop  Grumman  IT 


Shinjiro  Iwata,  CEO,  Hitachi  Data  Systems 


1 1 :30am  to  noon 
12:15pm  to  1:30pm 


Industry  Presidents’  Roundtable  and  Market  Outlook 


CONCURRENT  LUNCHEON  SESSIONS 


General  Networking 
Luncheon 


Concurrent  Luncheon 
Session 


Concurrent  Luncheon 
Session 


On  the  JW  Lawn 


Steve  Duplessie,  Founder 
&  Senior  Analyst, 
Enterprise  Storage  Group 


Richard  Sneider,  InterUnity 
Group 


1:30pm  to  2:00pm 
2:00pm  to  2:30pm 

2:30pm  to  3:00pm 

3:00pm  to  3:45pm 


David  Cohen,  VP,  Technology  Architecture  Group,  Merrill  Lynch 

Greg  Reyes,  Chairman  &  CEO,  Brocade  Communications  Systems 


y 

ii 


Rod  Mueller,  Manager  of  Technology  and  Infrastructure, 
International  Paper 

CTO  Insights  Panel 

Moderator;  Jon  William  Toigo,  Founder,  Toigo  Partners  International 


4:00pm  to  5:30pm 


CONCURRENT  SESSIONS 


5:30pm  to  8:30pm  Expo  with  Dinner  /  Interoperability  &  Solutions  Demo  Open  jE  jisS’1'"’  5:3°Pm  t0  8:3°Pm 

iPEMO 

WEDNESDAY,  OCTOBER  27 

7:15am  to  8:15am  Breakfast 

8:15am  to  8:30am  Opening  Remarks 


8:30am  to  9:15am 

9:15am  to  9:45am 
9:45am  to  10:15am 


Nick  Carr,  former  Executive  Editor  of  the  Harvard  Business  Review 
and  author  of  Does  IT  Matter? 


End  User  Case  Study 
Industry  Leader  Presentation 


10:30am  to  1 1 :00am 

1 1 :00am  to  1 1 :30am 

1 1 :30am  to  12:15pm 
12:15pm  to  1:45pm 
1 :45pm  to  2:15pm 
2:15pm  to  2:45pm 

2:45pm  to  3:30pm 


3:45pm  to  5:15pm 

5:15pm  to  7:15pm 
7:30pm  to  9:00pm 


3 


Michael  Prince,  CIO,  Burlington  Coat  Factory 


Peter  van  Oppen,  Chairman  &  CEO,  ADIC 


Panel:  End  Users  Speak  Out 
Expo  &  Luncheon 

End  User  Case  Study 
Industry  Leader  Presentation 


Analyst  Roundtable  Panel 

Moderator:  Jon  William  Toigo,  Founder,  Toigo  Partners  International 


INTEROPERABILITY  &  SOLUTIONS 
DEMO  OPEN 


12: 15pm  to  7:15pm 


& 


Interoperability 

&  Solutions 


DEMO 


See  SNW's  Interoperability 
&  Solutions  Demo 


CONCURRENT  SESSIONS 


Expo  and  Reception 

Gala  Evening,  Dinner  and  Entertainment 


40-plus  SNIA  member  companies 
collaborating  on  integrated  solutions 
the  opportunity  to  meet  leading 
experts  and  engineers 


THURSDAY,  OCTOBER  28 


7:30am  to  8:30am 
8:30am  to  Noon 
Noon 


Breakfast 


CONCURRENT  TECHNICAL  t  BUSINESS  TUTORIALS 


Conference  Concludes 


“SNW,  more  than  other 
conferences,  brings  together 
all  the  right  vendors  and  all 
the  right  users  -  users  who 
can  properly  leverage 
available  technology  and 
influence  vendors  in  develop¬ 
ing  the  next  generation  of 
storage  products.” 


Andre  Mendes 
Chief  Technology 
Integration  Officer 
Public  Broadcasting  Service 


"...  SNW  is  a  great  venue 
for  peer  discussion  ...  an 
opportunity  to  provide 
feedback  to  vendors  on 
what  users  need  from  them  ... 
I  sat  down  with  my  key 
vendors  and  shared 
information ..." 


John  Greer 

Director,  IT  Infrastructure 
Pacific  Gas  &  Electric 


JW  Marriott 
Grande  Lakes 
Resort 

Orlando,  Florida 


Hotel  Reservations 
and  Travel  Services 


IDG  Travel  is  the  official 
travel  company  for  Storage 
Networking  World.  They 
are  your  one-stop  shop 
for  exclusive  discounted  rates  on 
hotel  accommodations. 


mlDG 

TRAVEL  SERVICES 


To  reserve  your  accommodations,  visit: 

www.etcentral.com 

You  can  also  call  our  conference  housing  line  at: 

1-800-340-2262  (or  1-508-820-8686) 


For  more  information  and  to  register,  visit  www.snwusa.com/nww  or  call  1  -800-883-9090 
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Grande  Lakes  Resort 
Orlando,  Florida 


Application  for  Conference  Registration 

Fax  this  completed  application  to  1-508-820-8254  or  apply  online  at:  www.snwusa.com/nww 


Your  business  card  is 
REQUIRED 

to  process  your  application 

Please  affix  your  business  card  to  this  space  prior  to 
submitting  your  application.  Applications  submitted 
without  business  cards  will  not  be  processed. 

Questions?  Call  1-800-883-9090 


If  not  indicated  on  your  business  card,  please 
provide  the  following  required  information: 


Corporate  Email  Address 


Corporate  Website 


Registration  questions? 

Call  1  -800-883-9090  or  email  snwreg@computerworld.cor 

Need  accommodations? 

Reserve  them  at:  www.etcentral.com 

Please  call  1-800-340-2262 
or  email:  eventhousing@idg.com 


Please  check  ONE  of  the  following: 

Earlybird  Registration  (through  September  14,2004) 

Full/Onsite  Registration  (after  September  14,  2004) 

□ 

1  am  an  IT  End-User* 

(Complete  Attendee  Profile  below) 

□  $895  General  Conference  Package  (October  26  &  27) 
(includes  General  Conference  Sessions,  Expo,  Meals  &  Receptions) 

□  $1,290  Total  4-Day  Package  (October  25,  26,  27,  28) 
(includes  General  Conference,  plus  Technical  and  Business  Tracks, 
SNIA-produced  Tutorials,  SNIA-Certification  “Test-Ready"  Courses) 

□  $1,295  General  Conference  Package 

(includes  General  Conference  Sessions,  Expo,  Meals  &  Receptions) 

□  $1,690  Total  4-Day  Package  (October  25,  26,  27,  28) 

(includes  General  Conference,  plus  Technical  and  Business  Tracks, 

SNIA-produced  Tutorials,  SNIA-Certification  “Test-Ready"  Courses) 

*  IT  End-Users  are  defined  as  those  who  are  attending  Storage  Networking  World  with  an  intent  (and  an  IT  spending  budget)  to  potentially  buy/lease  hardware/software/services,  etc.  from  our  conference  sponsors  and  are  not  themselves  an  IT  vendor.  As  such,  account  representatives, 
business  development  personnel,  analysts,  consultants  and  anyone  else  attending  who  does  not  have  IT  purchasing  influence  within  their  organization  are  excluded  from  the  "IT  End-User"  designation.  Interpretation  and  enforcement  of  this  policy  are  at  the  sole  discretion  of  Computerwor 


□  I  am  a  Channel  Partner/ 
Integrator/Consultant 

(Complete  Attendee  Profile  below) 


□  $3,000  Total  4-Day  Package  (October  25,  26,  27,  28) 
(includes  General  Conference;  Technical  and  Business  Tracks, 
SNIA-produced  Tutorials,  SNIA  Certification  “Test-Ready"  Courses) 


□  $3,000  Total  4-Day  Package  (October  25,  26,  27,  28) 
(includes  General  Conference;  Technical  and  Business  Tracks. 
SNIA-produced  Tutorials,  SNIA  Certification  “Test-Ready"  Courses) 


By  participating  in  SNW’s  Channel  Partner/Integrator  registration  package,  registrants  may  enjoy  the  following  benefits:  One  company  representative  may  receive  a  full  conference  pass  to  SNW  Fall  2004;  additional  company  representatives  pay  $695  each  | 
for  full  conference  passes;  company  may  invite  up  to  five  IT  User  customers  to  attend  SNW  Fall  (IT  Users  must  be  strictly  compliant  with  IT  User  definition  on  the  supplied  registration  form);  companies  registering  for  this  package  interested  in  joining  the 
SNIA  are  eligible  to  receive  a  $2,000  discount,  provided  that  membership  is  applied  for  prior  to  January  1, 2005. 

Attendee  Profile:  This  section  MUST  be  completed  by  IT  End-Users  and  Channel  Partners/Integrators/Consultants  only  (optional  for  all  other  registrations)  in  order  to  process  your  application. 


Your  Business/Industry 

□  Transportation/Utilities 

□  Mining/Oil/Gas 

□  Non-Profit/Trade  Association 

□  Media/Publishing 

□  Banking 

□  Finance 

□  Accounting 

□  Insurance 

□  Real  Estate 

□  Telecommunications 

□  Wholesale/Retail  (non-computer) 

□  Computer  Service  Provider 

□  Advertising/Marketing/Publlc  Relations 

□  Entertainment 

□  Education 

□  Food  Industry 

□  Government/Military 

□  Healthcare/Medical  Services 

□  Travel/Hospitality/Recreation 

□  Manufacturing  (non-IT) 

□  VAR/VAD/ASP/System  Integrator 
(Channel/Integrator/Consultants  Only) 

□  Industry  Consultant/Storage  Solution  Integrator 
(Channel/Integrator/Consultants  Only) 


□  Manufacturing  (IT)  (Channel/Integrator/Consultants  Only) 

□  Computer  Retailer/Dealer/Wholesaler 
(Channel/Integrator/Consultants  Only) 

□  Software  Development  (Storage) 
(Channel/Integrator/Consultants  Only) 

□  Other  Computer  Related  (Storage) 
(Channel/Integrator/Consultants  Only) 

□  Other 

Your  Job  Title/Function 

□  CEO/COO/Chairman/President 

□  CIO/CTO 

□  VP/GM/Director 

□  IS/IT  Director/Manager 

□  Other  IS/IT  Department  Manager/Supervisor 

□  Other  Corporate/Business  Manager 

□  CEO/COO/Chairman/President 
(Channel/Integrator/Consultants  Only) 

□  CFO/Controller/Treasurer 
(Channel/Integrator/Consultants  Only) 

□  VP/GM/Director  (Channel/Integrator/Consultants  Only) 

□  Sales/Marketing/Product  Staff 
(Channel/Integrator/Consultants  Only) 

□  CIO/CTO/Other  IS/IT  Manager 
(Channel/Integrator/Consultants  Only) 

□  Engineering  Staff  (Channel/Integrator/Consultants  Only) 


The  one  item  that  best  describes  your  involvement  in  the 
IT  purchase  process 

□  Authorize  the  purchase 

□  Approve  the  budget 

□  Initiate  the  purchase 

□  Evaluate/recommend  products,  brands,  vendors 

□  Identify/establish  the  need  to  purchase 

□  All  of  the  above 

Number  of  employees  in  your  entire  organization  (ALL  locations) 

□  Over  10,000 

□  5,000-9,999 

□  1,000-4,999 

□  500-999 

□  Less  than  500 

What  is  the  estimated  annual  revenue  of  your  entire 
organization? 

□  Over  $10  Billion 

□  $1  Billion  -  $9.9  Billion 

□  $500  Million  -  $999  Million 

□  $100  Million  -  $499  Million 

□  Less  than  $100  Million 


Your  organization's  annual  IT/IS  budget  for  all  IT/IS 
products,  or  if  you  are  a  Channel/Integrator  Partner  or 
Consultant,  what  is  the  annual  dollar  value  of  IT  prod¬ 
ucts/services  you  sell/resell/recommend/influence  for 
purchase  by  your  customers/clients. 

□  Over  $  1  Billion 

□  $500  Million  -  $999  Million 

□  $100  Million -$499  Million 

□  $10  Million  -  $99  Million 

□  $1  Million  -  $9  9  Million 

□  Less  than  $1  Million 

Annual  company  IT  budget  (storage  products  and  services 

□  Over$1  Billion 

□  $500  Million  -  $999  Million 

□  $100  Million  -  $499  Million 

□  $10  Million- $99  Million 

□  $1  Million  -  $9.9  Million 

□  Less  than  $1  Million 

Would  you  like  to  receive  information  about  playing  in 
the  golf  outing  on  Monday,  October  25th? 

□  Yes 

□  No 


}  My  company  is  Sponsoring/ 
Exhibiting  at  SNW 


□  $895  (through  September  14,  2004) 

General  Conference  Package  (October  26  &  27) 

(includes  General  Conference  Sessions,  Expo,  Meals  &  Receptions) 

□  $1,290  Total  4-Day  Package  (October  25,  26,  27,  28) 
(includes  General  Conference,  plus  Technical  and  Business  Tracks, 
SNIA-produced  Tutorials,  SNIA-Certification  “Test-Ready"  Courses) 


□  $1,295  (after  September  14.  2004) 

General  Conference  Package  (October  26  &  27) 

(includes  General  Conference  Sessions,  Expo,  Meals  &  Receptions) 

□  $1,690  Total  4-Day  Package  (October  25,  26,  27,  28) 
(includes  General  Conference,  plus  Technical  and  Business  Tracks, 
SNIA-produced  Tutorials,  SNIA-Certification  “Test-Ready"  Courses) 


As  a  sponsor,  you  may  be  eligible  to  attend  using  a  registration  provided  with  your  sponsorship.  (If  those  registrations  have  already  been  assigned/used,  then  you  may  register  at  the  prevailing  rates  above.)  See  the  current  list  of 
sponsors  at  www.snwusa.com.  Questions?  Call  1  -800-883-9090  or  email  snwreg@computerworld.com. 


Q  I  ama  representative  of  a  Non-Sponsoring  IT  Vendor  Company 

□  $5,000  Business  Development  Professional  Package  for  Sales,  Marketing  and  Business  Development  Professionals  (includes  General  Conference  Sessions,  Expo,  Meals  &  Reception: 


Vendors  are  encouraged  to  participate  in  Storage  Networking  World  through  sponsorship.  (Details  are  available  by  calling  Ann 
Harris  at  508-820-8667.)  Alternatively,  vendors  (as  well  as  other  “non-IT  end-user"  professionals  as  defined  by  Computerworld), 
may  apply  for  registration  at  the  “non-sponsoring  vendor"  rate  of  $5,000.  Determination  of  what  constitutes  a  “non -sponsoring 
vendor"  registration  is  made  exclusively  by  Computerworld.  Please  call  888-239-4505  with  questions 


□  I  am  a  Financial/Equity  Analyst 

□  $1,290  (through  September  14,  2004) 
General  Conference  Package 
(includes  General  Conference  Sessions,  Expo, 
Meals  &  Receptions) 


and/or  Venture  Capital  Professional 

□  $1,690  (after  September  14,  2004) 
General  Conference  Package 
(includes  General  Conference  Sessions,  Expo, 
Meals  &  Receptions) 


□  I  am  a  qualified  member  of  the  press.  I  can  verify  my  press  credentials. 

Press  should  call  Erin  Keefe  at  1-781-91 5-5009  to  register. 

Please  fax  this  completed  application 
to  1-508-820-8254 


Payment  Method 

□  Check  i  checks  must  be  received  by  October  5,  2004  payable  to:  Computerworld) 

Mail  to:  Computerworld,  Attn:  Pam  Malingowski,  500  Old  Connecticut  Path,  Framingham,  MA  0 11 

□  American  Express  □  VISA  □  MasterCard 

Account  Number: _ 

Expiration  Date: _ _ _ _ _ ; 

Card  Holder  Name:  _ 

Signature  of  Card  Holder: _ 

Cancellation  Policy  (All  of  the  following  require  written  notification  by  October  5. 2004.) 

In  the  event  of  cancellation,  the  registrant  has  three  options: 

1 )  He  or  she  may  substitute  another  attendee  for  this  conference. 

2)  He  or  she  may  transfer  this  registration  to  the  Storage  Networking  World  Spring  2005  conference 

3)  The  registration  fee  will  be  refunded,  less  a  $250  serwCe  charge  (if  written  notice  is  receded  by  October  5. 20C 

Please  send  cancellation  requests  via  email  to:  snwreg@computerworld.com 
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LAN/WAN  SWITCHES  AND  ROUTERS 
ACCESS  DEVICES  ■  SERVERS  ■  VPNS 
OPERATING  SYSTEMS  ■  NETWORKED  STORAGE 
VOIP  ■  WIRELESS  NETWORKS 


Check  Point  faces  up  to  challenges 

Security  company  is  integrating  its  software  in  network  gear,  selling  its  own  appliances. 


Check  Point  by  the  numbers 

Despite  maintaining  a  strong  position  in  the  security  market.  Check  Point 
has  a  way  to  go  to  get  its  revenue  and  earnings  back  up  to  2001  heights. 


■  BY  TIM  GREENE 

You’d  think  Check  Fbint  might  be  hitting 
its  peak  given  that  network  security  has 
become  the  top  priority  for  so  many  IT 
shops.  But  the  firewall/VPN  company  actu¬ 
ally  is  facing  some  of  its  stiffest  challenges. 

Putting  the  pressure  on  Check  Point  are 
Alcatel,  Cisco  and  Enterasys  Networks, 
which  have  introduced  frameworks  for 
safeguarding  networks  that  involve  em¬ 
bedding  security  enforcement  in  routers 
and  switches.  Separately,  Juniper  spent  $4 
billion  to  snap  up  NetScreen  Tech¬ 
nologies,  one  of  Check  Points  biggest 
rivals.  Meanwhile,  security  software  ven- 


Takes 

■  The  SCO  Group  last  week  unveiled 
a  developer  version  of  its  upcoming 
OpenServer  operating  system. 

Code-named  Legend,  the  operating 
system  will  include  PostgreSQL  and 
MySQL  relational  databases,  and 
support  for  symmetric  multiprocess¬ 
ing,  load-balancing  and  VPN  environ¬ 
ments.  Also  included  is  SCOx  Web 
Services,  which  features  Simple 
Object  Access  Protocol  and  XML- 
based  libraries  and  tools.  SCO 
OpenServer  runs  on  Intel  and  AMD 
server  platforms.  It  is  expected  to 
I  ship  in  the  first  quarter  of  2005. 

Pricing  will  be  announced  then.  Visit 
.  www.scogroup.com/products/beta 
for  information  on  the  beta  program. 

■  HP  last  week  introduced  its  first 
storage  arrays  that  use  Serial 
Advanced  Technology  Attachment 
drives.  The  StorageWorks 
Modular  Smart  Array  1500  is  a 
storage  enclosure  that  supports 
either  SCSI  or  Serial  ATA  drives  and 
can  be  used  for  storing  fixed  content. 
A  second  product,  the  MSA  20,  is  a 
storage  array  that  supports  as  much 
as  8T  bytes  of  Serial  ATA  disk.  An 
MSA  1500  configured  with  MSA  20 
storage  starts  at  $9,000;  the  MSA  20 
starts  at  $2,960. 


dors  Internet  Security  Systems,  Symantec 
and  others  are  offering  firewalls  and 
VPNs  alongside  applications  such  as 
anti-virus,  intrusion  prevention  and  intru¬ 
sion  detection. 

As  competitors  have  made  their  moves, 
Check  Point  hasn’t  sat  idly  by  In  a  depar¬ 
ture  from  its  history  as  a  software-focused 
company,  Check  Point  has  rolled  out  a 
series  of  appliances  to  meet  demand  for 
simpler-to-implement  security  gear.  And  it 
has  expanded  its  technology  scope  with 
two  appliances  to  protect  not  only  net¬ 
work  perimeter  and  WAN  connections  but 
also  Web  and  LAN  traffic. 

And  earlier  this  year,  the  company 
acquired  Zone  Labs  for  $205  million  to 
obtain  endpoint  security  technologies 
used  for  checking  remote  computers 
before  granting  them  network  access. 

Still,  the  company  was  slow  to  get  into 
these  new  areas  and  paid  the  price,  says 
Jason  Wright,  program  leader  for  security 
technologies  at  Frost  &  Sullivan.  “In  2002 
and  2003,  they  put  out  virtually  no  new 
products.  In  the  past  12  months  they’ve 
fixed  that  problem, but  it  cost  them  market 
share,”  he  says. 

Check  Point’s  share  of  the  firewall/VPN 
gateway  market  tumbled  from  27%  in 


■  BY  PHIL  HOCHMUTH 

Chelsio  Communications’  launch  of  a 
10G  bit/sec  Ethernet  network  interface 
card  for  about  $2,000  could  signal  the 
start  of  a  price  decline  that  will  encour¬ 
age  customers  to  embrace  the  high¬ 
speed  technology. 

The  fiber-based  N100  server  adapter  is 
half  the  size  and  60%  less  expensive  than 
competitive  products,  Chelsio  says. 
Gartner  says  the  average  price  of  a  10G 
NIC  is  about  $6,000. 

In  addition  to  accelerating  network 
connections, Chelsio’s  new  offering  can 
speed  processing  by  offloading  TCP/IP 
computations  from  servers,  the  company 
says. 

The  product,  which  runs  in  Linux,  Unix 
and  Windows  machines  outfitted  with 
PCI-X  slots,  was  launched  last  week  at 
LinuxWorld  Expo  in  San  Francisco. 


Revenue  (in  millions) 

$600 


2001  to  19%  last  year, Wright  says.The  com¬ 
pany  is  optimistic  about  coming  back 
though,  with  a  revenue  growth  forecast  in 
line  with  the  19%  growth  expected  in  the 
VPN/firewall  market  as  a  whole,  he  says. 

Fighting  back 

Since  its  founding  in  1993,  Check  Point 
has  been  near  the  top  of  the  firewall  and 
later  firewall/VPN  market  (Infonetics  says 


Gartner  predicts  the  price  of 
10G  NICs  will  be  about  $3,100  by 
2007,  almost  half  the  current 
average  price  of  $6,100. 


The  N100  is  based  on  chip  technology 
from  Chelsio’s  T100  host  bus  adapters  for 
iSCSI  storage  networking,  but  is  half  the 
size  of  theTlOO.The  size  lets  the  new  NIC 
be  deployed  in  smaller  servers  and 
makes  it  easier  to  install  multiple  cards  in 
one  box,  the  company  says. 

Chips  on  the  N100  let  the  NIC  take  over 
TCP/IP  packet  processing  from  a  server’s 
CPU.  Chelsio  says  this  lets  a  server 


Earnings  (in  millions) 


the  company  is  No.  3  behind  Cisco  and 
Juniper  in  the  latest  quarter  based  on 
sales). The  company  has  sold  its  software 
directly  to  IT  shops,  which  run  the  soft¬ 
ware  on  hardware  the  shops  select,  and  to 
appliance  makers,  such  as  Nokia. 

To  keep  itself  among  the  industry  lead¬ 
ers,  Check  Point  annually  has  devoted  at 
least  6%  of  its  revenue  on  research  and 
See  Check  Point,  page  20 


processor  devote  more  resources  to  run¬ 
ning  applications  and  the  operating  sys¬ 
tem.  The  company  says  this  architecture 
also  lets  it  handle  up  to  64,000  simulta¬ 
neous  TCP/IP  connections  on  one  NIC.  It 
says  this  is  52%  better  than  competing 
10G  Ethernet  NICs  from  S2IO  and  Intel  — 
the  other  two  vendors  with  10G  Ethernet 
NICs  on  the  market. 

Gartner  says  the  number  of  10G  NICs 
installed  will  jump  from  about  7,000  this 
year  to  550,000-plus  by  2007.  Large  orga¬ 
nizations  consolidating  servers  will  be 
driving  this  growth,  the  research 
firm  says. 

By  2007,  the  average  price  for  a  10G  NIC 
will  drop  to  about  $3,100  per  unit,  partly 
as  a  result  of  their  fiber  components 
becoming  less  expensive,  Gartner  says. 
The  emergence  of  a  copper  10G  standard, 
expected  in  2005,  also  will  drive  down 
price.  ■ 


Chelsio  launches  10G  Ethernet  for  less 
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Two  very  different  people  —  Burton 
Group’s  Jamie  Lewis  and  O’Reilly 
Media’s  Tim  O’Reilly  —  took  on  simi¬ 
lar  themes  during  keynote  addresses  at 
the  recently  concluded  Catalyst  Confer¬ 
ence  (Lewis)  and  the  Open  Source  Con¬ 
vention  (O’Reilly).  In  essence,  both  said 
the  computing  stack  had  grown,  Web  ser¬ 
vices  was  at  the  top  and  everything  else 
was  on  its  way  to  commodity  status. 

Back  in  the  day,  the  computing  stack  con¬ 
sisted  of  three  parts:  an  application  de¬ 
signed  to  solve  a  problem, an  operating  sys¬ 
tem  and  hardware  required  by  the  operat¬ 
ing  system.  Over  the  years  we  could  argue 


Web  services  turns  rock  star 


about  various  CPUs  such  as  the  Z-80, 8080 
and  6502.  But  today,  processors  are  com¬ 
modities  that  better  act  like  an  Intel  CPU. 
Then  there  were  the  operating  system 
wars,  going  back  to  C/PM,  DOS,  DR-DOS 
and  M/PM. The  GUI  saw  its  own  battles. 

But  today,  supposedly,  abstraction  layers 
and  middleware  are  designed  to  look  like 
a  black  box  to  the  top-level  Web  services. 
We’ve  even  created  the  term  service-ori¬ 
ented  architecture  to  describe  the  com¬ 
moditized  stuff,  the  plumbing,  if  you  will, 
that  supports  the  services  exposed  to 
the  user. 

It’s  as  if  these  services  were  the  rock  stars 
of  computing  and  everything  else  had  to 
knuckle  under  to  their  demands.  It’s  true 
that  Van  Halen’s  standard  performance 
contract  contained  a  provision  calling  for 
the  band  to  be  provided  with  a  bowl  of 
M&Ms,  but  with  all  the  brown  candies 
removed.  Not  that  David  Lee  Roth  hated 


brown,  but  it  was  an  easy  way  to  quickly 
see  if  the  show  promoter  had  read  the 
contract.  So  far  there’s  nothing  like  this  in 
Web  services,  as  far  as  1  know,  but  anything 
can  happen. 

What’s  really  sad  is  how  commoditiza¬ 
tion  stifles  innovation.  Web  services 
expect  certain  information  to  be  avail¬ 
able,  certain  functions  to  be  performed 
and  (especially)  certain  timings  to  be 
enforced.  Web  services  requests  all  run 
according  to  the  clock.  Mustn’t  keep  the 
rock  star  waiting!  So  even  though  some 
will  claim  there’s  still  room  for  innovation 
in“the  plumbing, ’’that  innovation  can  only 
support  two  results  —  a  smaller  form  fac¬ 
tor  (especially  for  hardware  but  also  for 
the  software  “footprint”)  or  a  lower  cost. 
Innovations  offering  additional  function¬ 
ality  need  not  apply  The  new,  fun,  exciting 
stuff  has  to  be  left  to  the  rock  stars.  How 
very,  very  sad. 


www.nwfusiQn.com  j 


Kearns,  a  former  network  administrator, 
is  a  freelance  writer  and  consultant  in 
Silicon  Valley.  He  reached  at  wired@ 
vquill.com. 


Tip  of  the  Week 


If  you  are  into  maps, 
graphics  or  dazzling  dis¬ 
plays  of  computing  power, 
then  I'm  sorry  if  you  didn’t 
see  David  Rumsey’s  keynote 
at  the  Open  Source  Confer¬ 
ence.  Rarely  does  a  display 
of  maps  bring  a  standing 
ovation,  but  this  did.  Visit 
www.davidrumsey.com  and 
explore  it  thoroughly. 


Snap  Appliance  debuts 
midrange  NAS  device 


■  BY  DENI  CONNOR 

Snap  Appliance,  in  its 
first  announcement 
since  being  acquired  by 
Adaptec,  says  it  is  enter¬ 
ing  the  midrange  net- 
work-attached  storage 
market. 

The  company  says  its  new  Snap  Server 
18000  is  designed  for  divisions  within  large 
businesses  or  as  secondary  storage  within 
a  data  center.  Snap  sells  more  NAS  units 
than  anyone,  based  on  its  strength  at  the 
low-end  of  the  market. 

The  box  boasts  from  2T  to  30T  bytes  of 
storage  capacity  and  uses  Snap’s  propri¬ 
etary  Guardian  operating  system,  which 
can  handle  block  and  file  information. 

Dan  Werthimer,  chief  scientist  for  the 
University  of  California  Space  Sciences 
Lab  in  Berkeley  recently  installed  a  Snap 
Server  18000  to  hold  6T  bytes  of  data.  The 
device  has  proven  resilient  enough  to  han¬ 
dle  business-critical  data,  he  says. 

“It’s  our  main  database  for  the 
SETl@Home  project,  so  it  has  to  handle  a 
lot  of  real-time  transactions,”  says  Wert¬ 
himer,  who  also  has  Network  Appliance  file 
servers. 

Snap  has  enhanced  its  Guardian  operat¬ 
ing  system  by  adding  support  for  symmet¬ 
ric  multiprocessing  sewers;  the  Network 
Data  Management  Protocol,  which  allows 
network-based  backup  of  NAS  devices; 
and  enhanced  support  for  iSCSI.  Snap’s 
iSCSI  implementation  now  supports  host 
bus  adapters  from  Intel,  Adaptec  and 
Alacritech  on  servers  running  Windows, 
Red  Hat  Linux  and  Solaris. 

The  company  also  has  enhanced  its  repli¬ 


cation  software  with 
byte-level  asynchronous 
duplication  of  data 
across  distance.  Called 
Serve  r-to-Server 
Synchronization  v2,  the 
software  now  allows  the 
bidirectional  replication 
of  data  between  NAS 
devices.  Snap  Server  18000  also  ships  with 
BakBone’s  embedded  NetVault  software, 
Computer  Associates’  eTrust  Antivirus  and 
native  snapshot  technology 
Snap  Server  18000  uses  dual  Intel  Xeon 
processors  and  inexpensive  7,200  RPM 
Serial  Advanced  Technology  Attachment 
disk  drives.lt  has  redundant, hot-swappable 
components  and  battery-backed  non¬ 
volatile  memory  for  fault-tolerance.  It  is 
equipped  with  software  called  Instant  Cap¬ 
acity  Expansion,  which  allows  for  the 
dynamic  and  uninterrupted  provisioning 
of  data  as  4T-byte  expansion  devices  are 
added  or  removed  from  the  array 
Analysts  say  Snap’s  Snap  Server  18000 
likely  will  compete  with  storage  devices 
from  big  name  vendors. 

“Snap  is  going  to  compete  with  Micro¬ 
soft  Storage  Server  2003  boxes,  but  will 
start  to  encroach  on  Network  Appliance 
filers  and  IBM’s  A1X  box.,”  says  Brian 
Babineau,  an  analyst  with  Enterprise 
Strategy  Group. 

A  2T-byte  Snap  Server  18000  will  cost 
$  15,000;  a  4T-byte  expansion  array  will  cost 
$18,000.  Both  are  expected  to  be  available 
later  this  month.  A  Fibre  Channel  host  bus 
adapter  will  be  required  to  link  Snap 
Server  18000  to  the  4T-byte  expansion  array 
Server-to-Server  Synchronization  will  cost 
$1,300  per  NAS  appliance.* 


By  far  the  largest  of  Snap's  NAS 
devices,  the  18000  scales  to  30T 
bytes. 


Check  Point 

continued  from  page  17 

development,  which  Wright  says  puts  it  in 
about  the  middle  of  the  range  of  what 
competitors  spend. 

It’s  the  introduction  of  a  series  of  new 
boxes  over  the  past  year  that  signals  per¬ 
haps  the  biggest  change  at  Check  Point, 
which  has  maintained  profit  margins  of 
43%  or  better  over  the  past  five  years  by 
concentrating  on  software.These  offerings 
include  an  Secure  Sockets  Layer  remote- 
access  appliance,  a  LAN  firewall/quaran¬ 
tine  device  and  a  firewall/VPN  box  for 
small  and  home  offices. 

But  the  company  isn’t  entirely  out  of  the 
woods.  By  selling  hardware  and  software, 
it  is  drastically  changing  the  rules  by 
which  it  does  business,  which  affects  its 
extensive  and  lucrative  open  platform  for 
security  (OPSEC)  program.  OPSEC  part¬ 
ners  include  3Com,  NEC,  Nortel  and 
Symantec,  whose  gear  either  incorporates 
Check  Point  technology  or  is  certified  to 
work  with  it. 

The  OPSEC  partner  most  successful  at 
putting  Check  Point  software  on  appli¬ 
ances  is  Nokia,  which  sells  enough  of  the 
boxes  to  rank  fourth  among  firewall/VPN 
appliance  vendors,  according  to  IDC.  But 
now  that  Check  Point  is  selling  appli¬ 
ances,  it  now  competes  with  Nokia.  “The 
partnership  is  wavering  a  bit,”Wright  says. 

Initially  the  new  Check  Point  appliances 
don’t  compete  directly  with  those  of  its 
major  hardware  partners  such  as  Nokia, 
but  that  inevitably  will  happen,  says  Jeff 
Wilson,  director  of  research  for  Infonetics. 

Check  Point  will  need  to  do  a  good  job 
maintaining  relationships  with  partners  as 
it  goes  about  selling  its  own  gear,  Wilson 
says.That’s  because  the  company  needs  to 
strengthen  its  partnerships  with  network 
equipment  vendors  in  the  face  of  stepped- 
up  competition  from  companies  such  as 
Cisco,  Enterasys  and  Juniper,  he  says. “This 
is  something  they  absolutely  have  to  do," 


Wilson  says. 

Zeus  Kerravala,  vice  president  of  net¬ 
work  equipment  for  financial  firm 
Detwiler,  Mitchell,  Fenton  and  Graves,  says 
Check  Point  must  ensure  that  its  technol¬ 
ogy  plays  a  key  role  in  network  equip¬ 
ment  vendors’  security  schemes.  “I  think 
they  become  more  ‘Check  Point  inside, ’“ 
he  says. 

As  Check  Point  integrates  its  technolo¬ 
gies  with  those  of  others,  it  needs  to  make 
things  easy  for  customers,  says  Joel  La 
Calamita,  manager  of  infrastructure  and 
communications  for  the  American 
Institute  of  Physics.  He  ditched  Check 
Point-powered  Nokia  boxes  after  the  two 
vendors  couldn’t  figure  out  over  an  eight- 
week  period  why  the  boxes  were  acting 
up  after  an  upgrade,  he  says. 

“[Check  Point’s  VPN- 1 /Firewall-1]  is  still 
one  of  the  strongest  products  out  there, 
but  1  didn’t  have  the  luxury  to  stay  with  it,” 
says  La  Calamita,  who  switched  to  Juniper 
gear. 

He  says  problem  solving  just  became 
too  complex  given  that  a  valued-added 
reseller,  hardware  company  and  software 
company  all  were  involved. 

If  Check  Point  can  resolve  such  issues, 
the  company  could  continue  its  come¬ 
back  from  a  revenue  and  earnings  plunge 
suffered  in  2002  alongside  so  many  other 
IT  suppliers. 

“Check  Point  is  an  incredibly  strong 
brand,”  Kerravala  says. 

But  investors  aren’t  giving  the  company 
a  lot  of  wiggle  room.  Last  month  Check 
Pbint  announced  that  it  met  its  revenue 
goal  for  the  second  quarter,  but  its  stock 
price  immediately  fell  to  $17.70,  its  the 
lowest  point  this  calendar  year.  Why?  The 
company  didn’t  break  out  separate  ac¬ 
counting  of  revenue  from  the  Zone  Labs 
acquisition,  and  it  projected  slightly  lower 
third-quarter  revenue  than  some  Wall 
Street  analysts  wanted  to  hear.  Since  then 
the  stock  has  regained  some  of  its  value, 
reaching  above  $19  last  week.  ■ 


IBM  differs  in  acquisition  strategy 

Big  Blue  targets  smaller,  less-expensive  companies  that  have  easy-to-integrate  technology. 


■  BY  ANN  BEDNARZ 

Like  cyclist  Lance  Armstrong  in  the 
Pyrenees  Mountains,  IBM’s  acquisitions 
strategists  have  picked  up  the  pace.  Just  last 
month  the  company  added  application¬ 
monitoring  software  from  Cyanea  Systems 
and  business  intelligence  development 
tools  from  Alphablox  to  its  nearly  $15  bil¬ 
lion  software  division. 

One  reason  is  simply  opportunity  IBM  has 
loosened  the  purse  strings,  and  some  of  the 
smaller  companies  have  lowered  their  val¬ 
uations  so  they  can  get  bought,  says 
Jasmine  Noel,  a  partner  at  research  firm 
Ptak,  Noel  &  Associates. 

Additionally, customers  continue  to  gravi¬ 
tate  toward  large  vendors,  which  puts  pres¬ 
sure  on  small  vendors  to  get  acquired  and 
translates  into  bargains  for  the  big  players. 

“There  are  a  lot  of  companies  shopping 
themselves  around  very  aggressively”  says 
Jim  Murphy,  a  senior  analyst  at  AMR 
Research. “It’s  a  buyers’  market  right  now 


■  IBM  last  week  announced  it  has 
made  Sourcefire’s  intrusion-detec¬ 
tion  sensors,  including  the  Realtime 
Network  Awareness  appliance,  part 
of  its  managed  services  offerings. 
Sourcef  ire's  appliances  are  built  on 
the  IBM  xSeries  platform  and  can 
forward  encrypted  information  to 
IBM’s  Tivoli  Risk  Manager. 

■  Edify  this  week  is  expected  to 

upgrade  its  speech  platform, 

which  combines  traditional  interac¬ 
tive  voice-response  development 
tools  with  features  supporting 
VoiceXML,  speech  recognition  and 
business  application  integration.  The 
new  version,  called  Edify  Voice 
Interaction  Platform  9.0,  unbun 
dies  Edify’s  voice  application  server 
and  browser  to  give  users  more  pur¬ 
chasing  and  deployment  options. 
Voice  Interaction  Platform  9.0  is  due 
to  start  shipping  this  month.  Edify 
declined  to  discuss  pricing. 


for  IBM  and  other  big 
vendors.” 

In  IBM’s  case,  the 
buildup  of  its  services 
business  (boosted  sig¬ 
nificantly  with  the  2002 
purchase  of  Pricewater- 
houseCoopers’  consult¬ 
ing  arm)  is  another  rea¬ 
son  for  all  the  activity 
IBM’s  services  engage¬ 
ments  provide  a  ripe 
setting  for  identifying 
acquisition  targets  in 
areas  where  IBM  poten¬ 
tially  could  make 
money  Murphy  says. 

“The  services  business  is  giving  IBM  some 
insight  into  areas  of  fruitful  acquisition,”  he 
says.  “IBM  can  see  what  its  services  cus¬ 
tomers  need  and  evaluate  whether  the 


■  BY  JOHN  FONTANA 

Two  single  sign-on  vendors  are  upgrad¬ 
ing  their  products  in  an  effort  to  meet  the 
needs  of  corporate  users  warming  up  to 
identity  management. 

Passlogix  says  it  is  making  its  v-Go  SSO 
server  and  agent  software  more  extensi¬ 
ble  so  that  companies  can  customize  it  to 
meet  their  security  needs.  Version  5.0  has 
been  designed  to  house  a  series  of  plug¬ 
in  modules  and  also  supports  a  number 
of  new  directories  and  databases  to  store 
user  data. 

Separately,  Imprivata  last  week  shipped 
OneSign  2.5,  which  adds  a  password-reset 
feature,  support  for  biometrics  and  self¬ 
updating  agent  technology  to  the  compa¬ 
ny’s  single  sign-on  appliance. 

“Enterprise  SSO  has  come  of  age,”  says 
Jonathan  Penn,  an  analyst  with  Forrester 
Research.  “It  has  been  overlooked  for  a 
long  time  based  on  the  perception  that  the 
technology  had  shortcomings.” 

Much  of  that  perception  is  based  on  pass¬ 
word  synchronization  technologies  that 
are  less  expensive  than  SSO,  but  not  as 
secure,  according  to  Renn.  Password  syn¬ 
chronization  provides  one  password  for 
every  system,  which  can  result  in  weak 


need  is  repeatable.” 

Trigo  Technologies  is 
a  good  example.  IBM 
acquired  Trigo  for  its 
product  information 
management  software 
in  April.  Trigo’s  soft¬ 
ware  is  used  mainly  by 
retailers  and  con¬ 
sumer  goods  compa¬ 
nies,  linking  product- 
related  information 
such  as  size  and  color 
with  transaction  terms 
such  as  pricing,  and 
then  publishing  this 
information  to  internal 
and  external  systems. 

IBM  snapped  up  Trigo  in  time  to  catch  the 
wave  of  mandates  from  retailers  around 
data  synchronization  —  an  initiative  to  rec¬ 


passwords  on  systems  that  require  a  com¬ 
plex  password.  SSO  provides  a  single  pass¬ 
word  that  then  maps  to  the  password  for 
the  target  system.  The  differences  are  sub¬ 
tle,  but  SSO  generally  allows  for  more  com¬ 
plex  passwords  and  provides  administra¬ 
tors  a  single  point  to  cut  off  network  access 
instead  of  having  to  deactivate  accounts  in 
each  system.  SSO  also  incorporates  cen¬ 
tralized  access  policies  and  auditing  fea¬ 
tures  to  track  who  is  using  what  applica¬ 
tions  and  when. 

“There  is  a  lot  of  user  convenience,  man¬ 
agement  convenience,  and  for  security, SSO 


oncile  the  product  data  that  gets  swapped 
among  companies  to  reduce  errors  in  in¬ 
voicing,  purchase  orders  and  product 
delivery. Wal-Mart, Wegmans, Ace  Hardware, 
Lowe’s  and  The  Home  Depot  are  among 
retailers  requiring  their  suppliers  to  begin 
synchronizing  product  information 
through  UCCnet,  a  nonprofit  organization 
that  manages  an  item  registry  for  compa¬ 
nies’  product  data. 

“IBM  did  a  good  job  of  assessing  market 
opportunity  with  Trigo,”  Murphy  says. 

Keeping  it  small 

IBM  didn’t  disclose  what  it  paid  for  any  of 
its  last  five  software  company  purchases. 
But  in  the  first  half  of  the  year,  Big  Blue 
spent  a  total  of  $800  million  on  acquisi¬ 
tions,  according  to  its  most  recent  quarter¬ 
ly  financial  statement.  During  that  time,  IBM 

See  IBM,  page  24 


is  much  safer  and  [more]  secure  than  the 
status  quo  todajf  Penn  says. 

Passlogix  plan 

In  developing  v-GO  5.0  as  a  hub  for  plug¬ 
ins,  Passlogix  will  first  enable  the  software 
to  support  the  v-GO  Self-Service  Password 
Reset,  which  shipped  earlier  this  year. The 
technology  integrates  into  the  Windows 
logon  prompt,  adding  a  button  to  the  dia¬ 
log  box  for  one-click  access  to  password- 
reset  features. 

Before  year-end,  Passlogix  says  it  will  add 

See  SSO,  page  24 
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Jim  Murphy 

Senior  analyst,  AMR  Research 


Vendors  shore  up  ID  mgmt  tools 

Passlogix,  Imprivata  update  single-sign  on  wares. 


Signing  on 

Passlogix  and  Imprivata  are  updating  their  single  sign-on  offerings  to 
meet  growing  demand  for  identity  management  technology. 


Product 

What's  new 

Pricing 

Passlogix 
v-GO  5.0 

Software  is  now  a  platform  that  will 
anchor  plug-in  modules  such  as  self- 
service  password  reset. 

V-GO  5.0  is  $69.95  per  user. 
Self-service  module  costs 
$10  per  user. 

Imprivata 
OneSign  2.5 

Improvements  include  self-service 
password  reset,  biometrics  and  agent 
updating. 

$15,000  for  200  users;  up  to 
$160,000  for  10,000  users. 
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Redline  Networks  helps  medical 
records  management firm 
ChartOne  cure  network  pains 
and  boost  the  business  case  for 
its  Web-enabled  ERP  apps . 


, 

Redline  Networks’  E|X  3250  gave  Henry  Svendblad  the 
performance  he  was  after  for  ChartOne’s  Web  applications. 


NO  IT  EXECUTIVE  LOOKS  FORWARD  TO  ASKING  upper  management 
to  spend  $200,000  on  a  major  system  upgrade.  But  Henry  Svendblad, 
director  of  IT  at  ChartOne,  Inc.,  felt  he  had  little  choice. 


ChartOne,  based  in  San  Jose,  California,  sells 
technology  and  services  that  help  health  care 
institutions  easily  and  cost-effectively  access  and 
manage  patient  records.  To  better  serve  its 
customers,  which  represent  20%  of  hospitals  in  the 
U.S.,  and  to  ease  the  burden  on  its  own  IT  staff,  the 
company  wanted  to  migrate  its  ERP  applications  to 
the  Web. 

Like  many  companies  transitioning  to  Web- 
based  applications,  ChartOne  hit  performance 
snags  that  no  amount  of  application  tuning  and 
new  hardware  could  cure.  Only  after  two  years  of 
trial  and  error  did  ChartOne  find  a  cure  in  Redline 
Networks,  which  makes  a  family  of  appliances  that 
deliver  a  broad  set  of  capabilities  to  ease  the 
network  burdens  and  boost  the  business  case  for 
Web-enabled  applications.  With  Redline's  E|X  3250 
enterprise  application  processor  handling  I/O 
processing,  connection  management,  compression, 
load  balancing  and  SSL  processing,  ChartOne 
customers  and  internal  users  are  now  experiencing 
the  performance  they  require  —  and  the  company's 
IT  group  is  realizing  the  administrative  benefits  that 
Web-enabled  applications  can  bring. 

Network  Worid 

Nj  CUSTOM  MEDIA  SOLUTlOKiW 


ON  THE  WEB  TRAIL 

ChartOne's  odyssey  began  in  July  of  2001 ,  when 
the  company  began  migrating  its  homegrown 
client/server  enterprise  applications  to  Peoplesoft  8, 
a  Web-based  ERP  suite.  "We  were  expecting  growth 
of  20%  to  30%  a  year,  and  we  felt  we  needed  a  big 
ERP  system,"  Svendblad  says.  In  addition,  thin, 
standardized  browsers  would  require  far  less  IT 
support  than  fat,  homegrown  clients. 

If  ChartOne  was  going  to  offer  Web-based 
patient  records  management  services,  Svendblad 
also  felt  the  company  "should  eat  our  own  dog  food" 
and  use  a  Web-based  application  platform  internally. 

Webification  proved  to  have  its  challenges, 
however.  As  more  application  modules  and  users 
moved  onto  the  new  infrastructure,  response  times 
slowed  to  a  crawl.  Employees  at  the  company's  10 
remote  offices  sometimes  spent  hours  waiting  for 
tickler  screens  that  had  taken  minutes  to  display 
under  the  old  client/server  system.  The  10-  to  15- 
person  offices  had  plenty  of  bandwidth,  IT  staffers 
knew:  In  anticipation  of  the  migration  to  Peoplesoft 
8,  they'd  deployed  T1  links  to  each  site. 

Users  on  the  corporate  LAN  were  also  having 


difficulties.  By  far,  the  worst  off  was  the  accounts 
receivable  department,  which  processes  more  than 
300,000  transactions  per  month.  Productivity  had 
dropped  by  20%  because  of  response  time  degra¬ 
dation.  "During  peak  usage  periods,  it  was  taking 
people  minutes  to  go  from  screen  to  screen," 
Svendblad  says. 


ChartOne's  Challenges 


•  Web-enabled  enterprise  applications  were 
overloading  servers. 

•  Server  processors  were  at  80%  to  90% 
utilization  levels  during  peak  traffic  periods. 

•  Slow  response  tune  over  corporate  LAN  was 
hurting  user  productivity. 

•  Remote  users  waited  hours  for  screen 
downloads. 


The  Redline  Networks  Cure 


•  Average  server  CPU  utilization  during  peak 
usage  now  between  10%  and  15%. 

•  Response  time  returned  to  desirable  levels 
for  local  and  remote  users. 

•  Remote  sites  no  longer  need  terminal  servers. 

•  Bandwidth  consumption  decreased  approx¬ 
imately  70%. 

•  Savings  of  $200,000  by  avoiding  major 
hardware  upgrades. 


Photograph  by  Robert  Houser 
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setup  also  strained  budgets  and  IT  resources. 

Meanwhile,  Web  and  application  servers  were  still 
maxing  out  during  peak  usage  periods.  A  major 
upgrade  seemed  inevitable.  "It  looked  like  we  needed 
a  new  [BEA  Systems]  WebLogic  server,  a  new 
database  server  and  a  third  server  for  finance," 
Svendblad  says.  His  team  priced  out  three  SunFire 
servers  on  the  second-hand  market  at  about  $50,000 
apiece.  He  also  budgeted  $50,000  for  a  LAN 
upgrade,  bringing  the  total  budget  hit  to  $200,000, 
which  Svendblad  calls  a  conservative  estimate. 


IN  SEARCH  OF  A  CURE 

As  user  complaints  mounted,  the  IT  staff  began 
looking  for  remedies.  PeopleSoft  and  Oracle  — 
ChartOne's  application  vendors  —  initially  suggested 
fine-tuning  their  applications.  "With  a  thin  Web 
client,  ERP  systems  involve  complex  querying  in  the 
background,"  Svendblad  explains. 

When  tweaking  back-end  software  produced 
little  improvement,  ChartOne  tried  upgrading  its 
server  hardware.  It  deployed  another  Sun  420R 
application  server  and  storage  box,  then  migrated 
the  main  financial  server  from  a  420R  to  a  more 
powerful  SunFire  server.  "Performance  improved 
slightly,  but  we  were  still  looking  at  CPU  usage  in 
the  high  80%  to  90%  range  during  peak  processing 
time,"  Svendblad  says.  "And  our  phones  were  still 
ringing  off  the  hook." 

Pressed  for  answers,  ChartOne  even  took  the 
radical  step  of  supplying  remote  offices  and  home 
workers  with  terminal  servers.  While  that  substan¬ 
tially  improved  response  time,  maintaining  the 
devices  offsite  was  a  major  burden  on  the  IT 
support  staff.  "It  was  like  we'd  gone  back  to  a 
client/server  setup,"  Svendblad  says,  noting  the 


ONE  VERY  BRIEF  PILOT 

Just  as  he  was  about  to  swallow  that  bitter  pill, 
a  former  colleague  told  Svendblad  about  Redline 
Networks  in  Campbell,  Calif.,  and  its  family  of 
appliances  that  help  enterprises  manage  the 
network  impact  of  Web-enabled  applications  and 
improve  their  business  case. 

In  the  summer  of  2003,  ChartOne  deployed 
Redline's  E|X  3250  enterprise  application  processor 
in  front  of  its  WebLogic  servers.  The  Redline  device 
took  over  complex  scheduling  of  TCP  requests 
and  connection  management  chores  for  as  many 
as  150  users,  saving  the  Web  servers'  CPU  and 
memory  resources  for  other  activities  like  page 
generation.  The  E|X  also  performed  data  compres¬ 
sion  to  speed  up  server  response  and  conserve 
bandwidth. 

Svendblad's  group  started  out  with  a  pilot  test 
within  the  accounts  receivable  group,  which  took 
the  biggest  performance  hit  after  moving  to 
Peoplesoft  8.  Setting  up  users  was  simple  and 
transparent,  Svendblad  reports:  "I  just  changed  the 
local  DNS  setting,  and  when  users  clicked  on  the 
PeopleSoft  icon,  they  were  routed  through  the 
Redline  box.  We  didn't  have  to  change  anything  on 


our  existing  architecture,  or  on  the  WebLogic  or 
PeopleSoft  servers." 

User  response  was  fast  and  dramatic.  "People 
were  asking  us  if  we'd  put  some  magic  juice  in  their 
system,"  Svendblad  reports.  When  word  spread, 
end  users  not  involved  in  the  pilot  "were  pounding 
on  our  door  saying,  'Whatever  you  did  for  her,  do 
for  me!"'  It  may  have  been  the  shortest  pilot  on 
record:  A  day  after  the  test  started,  the  company 
routed  all  the  other  users  through  the  Redline  box. 

TALLYING  THE  BENEFITS 

Once  the  bulk  of  users  was  online,  the  benefits 
of  the  Redline  device  really  began  to  kick  in, 
Svendblad  reports.  Average  CPU  consumption 
during  peak  processing  time  plummeted  from  80% 
or  more  to  less  than  1 5%.  Bandwidth  consumption 
decreased  approximately  70%. 

The  E|X  3250  now  handles  SSL  encryption, 
as  well.  "We  have  security  without  burdening 
our  servers  with  managing  certificates  or  with  SSL," 
Svendblad  says.  The  company  also  saves  money  on 
SSL  certificates,  since  it  needs  only  one  for  the 
Redline  box  instead  of  one  for  each  server. 

Over  the  past  year,  ChartOne  brought  its 
customer  relationship  management,  HR  and 
Hyperion  Business  Performance  Management 
applications  behind  the  Redline  box.  Most  recently, 
the  company  added  its  View  Manager:  Chart 
Management  Suite  of  ASP  offerings  to  the  set  of 
applications  front-ended  by  the  E|X  platform. 


After  ChartOne  installed  the  Redline 
Networks  E|X  3250,  user  response 
was  dramatically  faster.  "People  were 
asking  us  if  we'd  put  some  magic 
juice  in  their  system,"  says  Henry 
Svendblad,  director  of  IT. 


ChartOne's  hundred-odd  remote  and  mobile 
users  have  completely  eliminated  their  terminal 
servers  and  use  a  standard  Web  browser  to  access 
all  applications,  via  the  E|X  3250.  "The  user  experi¬ 
ence  is  improved,  and  our  support  costs  are  lower," 
Svendblad  says. 

The  bottom  line:  ChartOne  successfully  imple¬ 
mented  a  Web-enabled  ERP  platform  with  a  "single 
box  solution"  that  addresses  critical  Web  tier  issues 
while  dramatically  improving  the  business  case  by 
increasing  user  productivity  and  avoiding  costly 
hardware  upgrades.  End  users  now  experience  the 
same  response  time  levels  and  productivity  they 
had  with  customized  fat  clients  —  but  IT  no  longer 
has  the  support  burden.  Says  Svendblad:  "I  think 
that's  pretty  impressive." 


LEARN  MORE  ABOUT  REDLINE  NETWORKS  ONLINE 


Sponsored  by 


Read  what  leading  analysts  and  other  customers  say 
about  Redline  Networks  at  our  new  InfoCenter,or  call  us  at: 

1.877.550.6420 

Visit:  www.redlinenetworks.com/infocenter 


NETWORKS 


NetworkWorld 


8/9/04 


Enterprise  Applications 


Our  tax  dollars, 


About  a  year  and  a  half  ago  the  U.S. 
government  released  the  “National 
Strategy  to  Protect  Cyberspace.”  This 
report  was  mostly  to  get  the  Department 
of  Homeland  Security  to  organize, support 
and  communicate  responses  to  and  pro¬ 
tection  from  attacks  on  the  U.S.  cybertech¬ 
nology  infrastructure.  Now  the  DHS  Office 
of  Inspector  General  has  issued  a  report 
card  on  how  DHS  is  doing  that  paints  a 
mixed,  but  on  the  whole  not  very  good, 
picture. 

The  cyberspace  strategy  (www.nwfu 
sion.  com,  DocFinder:  3227)  was  compre¬ 
hensive.  It  described  five  priorities  DHS 
should  take  into  account  when  consider¬ 
ing  U.S.  cybersecurity  and  recommended 
eight  specific  actions. 

According  to  the  strategy,  the  highest  pri¬ 
ority  was  development  of  a  national 
cyberspace  security  response  system. The 


other  priorities  included:  development  of 
national  cyberspace  security  programs  for 
threat  and  vulnerability  reduction  sys¬ 
tems;  creation  of  programs  for  awareness 
and  training;  development  of  ways  to 
secure  government  cyberspace;  and 
establishment  of  national  and  internation¬ 
al  cybersecurity  cooperation. 

The  eight  actions  listed  in  the  strategy 
provide  specific  suggestions  on  ways  to 
achieve  these  priorities. 

The  report  card,  titled  “Progress  and 
Challenges  in  Securing  the  Nation’s  Cyber¬ 
space”  (DocFinder:  3228),  notes  that  DHS 
has  done  a  few  cybersecurity  things  over 
the  last  year  that  were  called  for,  but  mostly 
says  that  DHS  needs  to  do  better. 

DHS  established  a  National  Cyber 
Security  Division  (NCSD)  about  year 
ago  to  focus  on  its  cybersecurity  efforts. 
NCSD  then  established  the  U.S. 
Computer  Emergency  Readiness  Team 
(US-CERT).  Its  Web  site,  www.us-cert.gov, 
has  some  useful  information.  But  it 
seems  to  be  largely  redundant  with  the 
15-year-old  CERT  Coordination  Center 
(CERT/CC)  at  www.cert.org  run  under 
federal  contract  by  Carnegie  Mellon 


almost  at  work 

University  when  it  comes  to  information 
about  specific  cybersecurity  attacks  and 
countermeasures. 

NCSD  also  established  the  National 
Cyber  Alert  System,  a  trio  of  mailing  lists 
run  by  US-CERT. 

According  to  the  report  card,  these 
lists  had  very  little  traffic  even  though  a 
quarter  of  a  million  people  had  sub¬ 
scribed  to  one  or  more  of  them.  NCSD 
also  participated  in  a  communication 
and  coordination  exercise  run  by 
Dartmouth  College,  hosted  a  National 
Cyber  Security  Summit  and  set  up  three 
government  organizations  dealing  with 
U.S.  government  cybersecurity. This  level 
of  achievement  seems  low  considering 
an  annual  budget  of  more  than  $75  mil¬ 
lion  for  the  cybersecurity  activity. 

The  report  card  said  NCSD  has  yet  to 
figure  out  how  to  prioritize  its  activities, 
set  specific  milestones  for  itself  or  figure 
out  just  how  much  money  it  will  need  to 
do  its  job.  Nor  has  NCSD  developed  a 
strategic  plan,  the  report  said,  defined  a 
way  to  measure  its  performance,  devel¬ 
oped  a  formal  communications  process 
within  itself  and  with  other  organiza- 
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tions,  or  figured  out  how  to  provide  for¬ 
mal  guidance  on  cybersecurity  issues  to 
the  DHS. 

Cybersecurity  is  an  ever-more  impor¬ 
tant  issue  in  these  troubled  times.  As 
one  measure,  the  CERT  has  issued  a  cou¬ 
ple  hundred  Technical  Cyber  Alerts  so 
far  this  year.  I’m  not  sure  that  the  most 
effective  way  to  fight  this  problem  is  to 
create  another  government  bureaucrat¬ 
ic  effort;  the  government-funded 
CERT/CC  has  done  quite  well  over  the 
years  and  private  efforts  such  as 
Symantec’s  security  response  Web  site 
(www.symantec.com/avcenter/)  do  an 
excellent  job  in  the  areas  they  cover. 
But,  if  there  is  to  be  a  government  effort, 
it  would  be  nice  if  we  got  more  for  our 
tax  dollars  than  we  have  from  DHS. 

Disclaimer:  Lots  of  our  tax  money  pays 
for  research  at  Harvard.  I’m  sure  it  is  all 
perfectly  justified,  but  I  did  not  ask  the  uni¬ 
versity  for  its  opinion. 

Bradner  is  a  consultant  with  Harvard 
University’s  University  Information  Sys¬ 
tems.  He  can  be  reached  at  sob@ 
sob.  com. 


In  the  bag 

IBM  snapped  up  two  software  companies  in  July,  bumping  its  total  to 
five  such  deals  in  eight  months. 


Acquired 

company 

Primary 

business 

Acquisition 

announced 

Cyanea  Systems 

Application  monitoring 

July  2004 

Alphablox 

Business  intelligence  development  tools 

July  2004 

Candle 

Mainframe  systems  management 

April  2004 

Trigo  Technologies 

Product  information  management 

March  2004 

Green  Pasture 
Software 

Document  management 

December  2003 

SSO 
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v-GO  Authentication  Management,  which 
will  support  the  use  of  smart  cards,  tokens 
and  biometric  devices  for  network  sign-on. 
A  module  for  linking  to  provisioning  sys¬ 
tems  will  follow,  says  Passlogix  CEO  Marc 
Boroditsky 

The  latest  version  of  v-GO  5.0  also  now 
supports  directories  from  IBM,  Oracle, 
Critical  Path  and  OpenLDARand  databases 
from  Oracle,  IBM  and  Microsoft.  Also  new 
are  tamper  detection  and  user-credential 
caching. 

Imprivata  update 

Imprivata  says  the  new  self-service 
password-reset  feature  for  its  OneSign 
appliance  is  aimed  at  reducing  help 
desk  calls. 

“We  were  spending  35%  of  our  IT  time  on 
password-related  issues,”  says  Paula 
Chesbrough,  CIO  of  Eagle  Bank  in  Everett, 
Mass.  “We’ve  reduced  that  workload  to 

io%: 

The  bank  installed  OneSign  less  than  a 
year  ago  to  improve  its  overall  network 
security  under  regulatory  pressure  and  to 
ease  password  duties  in  IT. 

Also  new  in  OneSign  is  fingerprint  ID 
technology,  which  eliminates  the  need  for 
a  keyboard.  A  new  self-updating  client 
agent  works  much  like  anti-virus  agents, 
updating  itself  with  new  rules  and  code 
automatically  Imprivata  also  has  added 
reporting  capabilities  to  track  users. 

OneSign,  which  comes  with  its  own 
internal  database  for  storing  user  creden¬ 
tials,  can  import  those  credentials  from 
any  directory  that  supports  the  Light¬ 
weight  Directory  Access  Protocol.  ■ 


IBM 
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closed  the  Trigo  acquisition  and  its  pur¬ 
chase  of  Candle,  which  makes  mainframe 
systems  management  software. 

In  2003,  IBM  spent  $1.8  billion  on  acqui¬ 
sitions,  including  the  purchase  of  docu¬ 
ment  management  software  maker  Green 
Pasture  Software.The  Green  Pasture  deal  is 
typical  IBM,  Murphy  says.  It  wasn’t  a  block¬ 
buster,  but  it  paves  the  way  for  IBM  to  help 
customers  deal  with  document  manage¬ 
ment  challenges  —  including  compliance 
with  looming  corporate  governance  legis¬ 
lation  such  as  the  Sarbanes-Oxley  Act. 

Whereas  EMC  paid  $1.7  billion  for  docu¬ 
ment  management  vendor  Documentum 
in  late  2003,  that’s  not  usually  IBM’s  style, 
Murphy  says.  “Green  Pasture  wasn’t  a  big- 
bang  acquisition,  so  IBM  didn’t  have  to 
spend  nearly  as  much,”  he  says. 

Nonetheless  IBM  picked  up  technology 
that’s  complementary  to  its  own  and  al¬ 
ready  used  by  a  number  of  IBM  customers, 
he  says.  Additionally  by  choosing  a  smaller 
vendor,  IBM  still  is  able  to  partner  fairly 
effectively  with  larger  content  manage¬ 
ment  players. 

Likewise,  IBM’s  two  most  recent  deals, 
Cyanea  and  Alphablox,  were  of  small  com¬ 
panies  that  already  partnered  with  IBM. 
“IBM  has  an  advantage  over  a  lot  of  other 
companies  when  it  comes  to  acquisitions, 
because  it  has  such  a  strong  ecosystem  of 
partners,”  Murphy  says.  “It  can  test  the 
waters  through  those  partnerships  pretty 
effectively 

The  Cyanea  purchase  extends  IBM’s 
application  problem  management  and  res¬ 
olution  capabilities,  says  Rich  Ptak,  partner 
at  Ptak,  Noel  &  Associates.“Combined  with 


Tivoli  and  Candle  technologies, it  will  allow 
IBM  to  ship  an  end-to-end  solution  for 
application/transaction  monitoring,  prob¬ 
lem  detection  and  diagnostics,  and  [even¬ 
tually]  a  problem  resolution  solution  that 
functions  in  both  the  mainframe  and  dis¬ 
tributed  environments,”  he  says. 

The  biggest  challenge  will  be  creating  a 
single,  integrated  package,  Ptak  says.  IBM 
has  assembled  all  the  pieces  needed  for 
management,  monitoring,  detection,  diag¬ 
nostics  and  repair, he  says.Now“the  pieces 
need  to  be  assembled  and  shipped  in  an 
integrated  whole,”  he  says. 

Market  time 

Integration  is  an  issue  in  any  technology 
acquisition.  How  quickly  IBM’s  acquired 
technology  gets  assimilated  varies.  Somet¬ 
imes  it’s  fast:  The  same  month  that  IBM 
announced  it  was  buying  Green  Pasture,  it 
provided  details  about  its  new  DB2  Docu¬ 
ment  Manager  product  based  on  Green 
Pasture  technology 

In  cases  when  IBM  is  buying  one  of  its 
partners,  API-level  integration  often  is 


already  available.  Beyond  that,  IBM  isn’t 
always  motivated  to  Completely  integrate 
acquired  technology  overnight,  Murphy 
says.  The  priority  is  to  get  the  products 
working  together  and  beef  up  that  integra¬ 
tion  over  time.  Keeping  the  products  dis¬ 
tinct  for  a  time  means  IBM  can  charge  for 
them  separately  he  says. 

Looking  ahead,  Ptak  suggests  IBM  could 
benefit  from  buying  network  device  man¬ 
agement  technology. 

Tools  for  mapping  infrastructure  rela¬ 
tionships  at  the  service  level  is  another 
gap  to  be  filled,  Noel  says.“Cyanea  can  do 
some  of  that,  but  only  for  [Java  2  Platform 
Enterprise  Edition]  platforms  —  and 
enterprises  have  a  lot  more  than  just 
J2EE,”  she  says.  Likely  acquisition  targets 
are  Collation  and  Troux  Technologies, 
Noel  says.B 
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Special  Focus 

APPLICATIONS:  Contact  applications. 


Address  book  apps  try  to  shake  spam  label 


■  BY  CARA  GARRETSON 

Plaxo,  the  free  contact  application  that  automatically 
updates  address  books  via  e-mail,  has  gained  notori¬ 
ety  since  it  was  launched  just  over  a  year  ago.  Now 
its  creators  are  pinning  the  application’s  future  on  a  paid, 
businessoriented  version  to  create  the  company’s  first 
significant  revenue  stream.  However,  given  the  privacy 
concerns  Plaxo  raises  and  the  widely  held  belief  that  the 
e-mails  it  generates  are  at  best  annoying  and  at  worst 
spam,  the  application  might  hit  a  wall  as  it  tries  to  pene¬ 
trate  corporate  America. 

Plaxo  has  garnered  more  than  2.5  million  users  who 
copy  the  address  books  in  their  Microsoft  Outlook  e-mail 
clients  to  the  Plaxo  server,  which  generates  e-mails 
requesting  contacts  update  their  phone  numbers  or 
addresses,  and  keeps  the  server  and  local  copy  up  to 
date.  Plaxo  doesn’t  charge  users  for  the  software,  instead 
collecting  $20  per  year  from  customers  interested  in  “VIP” 
support. The  company  also  says  there  are  plenty  of  small 
businesses  using  the  tool,  especially  since  it  added  group 
calendaring  and  expanded  note-taking  capabilities  in 
Version  2.0  that  was  released  in  May 
Before  year-end,  the  company  plans  to  release  a“premi- 
um”version  —  Plaxo  officials  won’t  yet  say  how  much  it 
will  cost.  With  both  individual  and  per-seat  pricing,  this 
version  is  aimed  at  the  business  market  and  adds  the  abil¬ 
ity  to  automatically  clean  up  address  books  (deleting 
duplicate  entries)  and  a  back-up  and  recovery  capability. 

Although  the  company  thinks  the  premium  version  will 
appeal  most  to  small  businesses,  the  company  also  is  set¬ 
ting  its  sights  on  larger  outfits.“Our  approach  is  going  to 
be  to  enter  organizations  from  the  bottom,” says  Rikk 
Carey,  Plaxo’s  vice  president  of  engineering.“One  day  you 
may  see  us  selling  enterprise  versions.” 

Yet  the  concerns  that  the  Plaxo  model  raises  —  critics 
say  collecting  and  storing  contact  information  and  rela¬ 
tionships  on  a  central  server  (see  graphic)  is  risky  for 
users  —  it  might  keep  Plaxo  out  of  many  small  business¬ 
es,  nevermind  large  companies  that  tend  to  be  more  sen¬ 
sitive  to  letting  information  out  of  their  networks.“lt  poses 
a  huge  risk  to  any  company  says  Will  Hayden,  senior  net¬ 
work  administrator  at  All  Phase  Communications,  a  tele¬ 
com  dealer  in  Seattle  with  30  users  on  its  internal  net- 
work.“You’re  sending  your  database  contacts  over  to  a 
third  party’ 

Plaxo  isn’t  alone  in  this  category;  products  from  Corex 
Technologies,  GoodContacts  and  others  use  a  similar 
model  to  keep  address  books  up  to  date.  Corex  is  attempt¬ 
ing  to  leverage  the  success  it  has  found  with  its  business- 
card  scanner  to  sell  its  AccuCard  service,  which  automati¬ 
cally  sends  update  requests  to  contacts  to  corporations 
via  e-mail  once  a  quarter. 

However,  one  analyst  notes  that  competing  against  a 
free  product  like  Plaxo  is  an  uphill  climb.The  number  of 
adopters  of  Corex’s  service  is  not  nearly  as  impressive  as 
Plaxo s” says  Avi  Greengart, senior  analyst  with  Jupiter 
Research.  Corex  charges  $49.95  per  year  for  AccuCard. 

Widespread  adoption  of  these  types  of  applications  in 
the  corporate  environment  is  questionable,  Greengart 
adds,  because  it’s  difficult  to  convince  users  to  pay  for  a 
service  that’s  been  available  for  free.Tm  still  somewhat 


skeptical  that  anyone  can  make  it  work,  but ...  1  would 
give  Plaxo  the  nod.  Scale  does  help;  if  you  need  a  whole 
bunch  of  people  to  convert  to  a  paid  [model] ,  it  helps  to 
have  a  whole  bunch  of  people  to  begin  with,”  he  says. 

Among  the  products  in  this  category,  Plaxo  seems  to 
have  made  the  most  noise.This  is  astonishing,  consider¬ 
ing  the  company  spends  no  money  on  marketing  or 
advertising,  relying  instead  on  its  members  to  pull  in  new 
users.  (Each  Plaxo  message  sent  out  includes  a  sentence 
encouraging  the  recipient  to  join  the  network.)  A  quick 
review  of  opinion  columns  and  Web  blogs  shows  that 
Plaxo  also  has  received  the  most  criticism,  particularly 
from  people  who  feel  the  information  it  stores  is  invalu¬ 
able  and  easily  could  fall  into  the  wrong  hands. 

“The  notion  that  a  central  place  is  collecting  relation- 


feature  that  lets  the  recipient  of  a  Plaxo  e-mail  challenge 
the  sender  to  prove  how  they  know  each  other.  Plaxo 
tracks  when  its  users  are  challenged,  and  if  a  particular 
user  gets  an  abundance  of  challenges  (Carey  says  10 
would  be  considered  a  lot)  then  the  user  is  kicked  off. 

From  a  privacy  standpoint,  there’s  no  reason  for  busi¬ 
nesses  to  avoid  using  Plaxo, says  John  Pironti,  a  security 
consultant  at  Unisys  who  advises  the  computer  maker’s 
large  enterprise  customers.'The  privacy  agreement  is 
solid,  and  Plaxo  seems  to  be  abiding  by  it.  Everything  in 
security  is  about  balance,  and  here  the  benefits  outweigh 
the  risks,”  Pironti  says.  However,  he  questions  whether 
large  companies  will  need  it.“A  lot  of  corporations  have 
been  driving  this  concept  internally  —  there’s  a  lot  of 
push  to  put  in  directory  systems  with  active  notification 


The  power  of  the  network 

Plaxo  attracts  new  users  by  relying  on  members  to  sign  up  their  contacts. 


O  Jane,  a  Plaxo  user,  asks  her  friend 
Joan  to  update  contact  information. 


Jane 

O  The  chain  continues: 
Joan  asks  friends  to 
update  their  contact 
information.  E-mail 
requests  are  sent 
to  Joan's  friends. 


Joan’s  friends 


^  7 


o  E-mail  is  sent  to  Joan;  Joan’s  response  updates  Jane’s 
local  address  book  and  the  version  stored  on  Plaxo’s 
servers. 


Joan 


> 

Jane’s 

Joan's 

address 

address 

book 

book 

J 

y 

4 

Joan  decides  to  join  Plaxo,  and  syncs 
her  address  book  with  the  Plaxo 
server.  A  link  is  established  between 
Joan  and  Jane,  so  whenever  Jane 
updates  her  contact  information  it’s 
reflected  in  Joan’s  address  book. 


ships  makes  me  nervous.  I’m  in  your  contact  book  and 
you  can  find  a  whole  bunch  of  people  who  are  related 
[to  me]  ....  that’s  great  for  target  marketing”  says  David 
Jameson,  founder  of  DigiPbrtal,  which  makes  an 
e-mail  challenge-response  tool  for  verifying  message 
senders  by  forcing  them  to  validate  their  identity  before  a 
message  is  received. 

The  oft-repeated  response  from  Plaxo,  as  outlined  in  the 
privacy  agreement  posted  on  the  company’s  Web  site,  is  it 
does  not  share  its  users’  information  with  any  third  par¬ 
ties.  And,  if  Plaxo  is  bought  or  goes  into  bankruptcy,  users 
will  be  alerted  and  given  the  opportunity  to  delete  their 
information  from  Plaxo’s  servers  before  ownership 
changes  hands,  Carey  says. 

However,  Carey  acknowledges  that  many  of  the  privacy 
concerns  directed  at  Plaxo  are  valid.“We  live  in  a  time 
where  the  world  is  pretty  disruptive;  there’s  crazy'  stuff 
going  on.  By  Plaxo’s  nature,  we  tickle  that  [privacy]  con¬ 
cern,  you  get  an  e-mail  from  someone  that  shows  your 
personal  information,  it’s  a  little  scaryfhe  says.“People 
assume  the  worst." 

To  help  calm  these  concerns,  Plaxo  recently  added  a 


—  so  1  wonder  about  the  market  viability  for  an  enter¬ 
prise  version.” 

Another  complaint  against  Plaxo  is  that  the  e-mails  it 
generates  are  spam.  Proponents  deflect  that  criticism, say¬ 
ing  Plaxo  e-mails  simply  request  that  someone  the  sender 
knows  updates  their  contact  information  and  are  not 
commercial  messages. 

Businesses  will  have  to  give  this  issue  a  hard  look 
before  sanctifying  the  application  for  corporate  use,  lest 
they  be  accused  of  sending  irritating  messages  or,  worse 
yet,  junk  e-mail.  In  addition,  many  companies  might  not 
want  to  be  viewed  as  Plaxo  advertisers. 

Whether  Plaxo  gains  a  foothold  in  the  small-business 
and  eventually  enterprise  markets  likely  won’t  affect  the 
product’s  popularity  among  individual  users. Wlrat  it 
might  well  affect  is  the  company’s  viability;  Plaxo  has 
attracted  $20  million  in  funding  and  is  banking  on  the 
paid  version  of  the  application  to  increase  the  small 
amount  of  revenue  it  collects  for  VIP  support,  according 
to  vice  president  of  marketing  Scott  Epstein. That  leaves 
the  paid  version  of  Plaxo  to  carry  the  weight  of  the  com¬ 
pany  and  to  ensure  the  free  version  stays  that  way:  ■ 
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■  Global  broadband  prices  fell 

sharply  in  the  first  half  of  the  year  as 
cable  operators  moved  to  meet  the 
challenge  of  lower  prices  from  DSL, 
according  to  a  research  report. 
Monthly  rental  fees  for  broadband 
cable  services  dropped  16%  in  the 
first  six  months  of  this  year,  while  DSL 
fees  were  slashed  by  13%,  reported 
researcher  Point  Topic.  Broadband 
cable  service  providers  aggressively 
cut  prices  during  the  first  half  of  the 
year  to  bring  their  fees  closer  to  those 
of  DSL  services,  which  previously 
were  reduced  to  attract  new  sub¬ 
scribers.  Cable  operators  surveyed 
said  the  average  monthly  rate  for 
entry-level  cable  modem  services 
declined  from  $39.20  to  $32  over  the 
period,  while  DSL  prices  dropped  by 
$2.50  to  $29.50. 

■  Amedia  Networks,  a  developer  of 
Ethernet  broadband  access  prod¬ 
ucts,  last  week  announced  that  it  has 
expanded  its  technology  licensing 
agreement  with  Lucent.  Lucent  has 
delivered  to  Amedia  several  Bell 
Labs-developed  technology  designs 
for  Amedia's  PG1000  premises  gate¬ 
way  and  AS5000  Aggregator  Switch. 
As  part  of  the  agreement,  Lucent  will 
provide  additional  technology  designs 
for  further  product  enhancements  for 
the  PG1000  and  AS5000.  Amedia  also 
is  enhancing  its  CS1200  Ethernet 
core  switch  with  a  suite  of  software 
features  to  improve  traffic  manage¬ 
ment  and  security,  and  design  im¬ 
provements  to  reduce  its  production 
cost. 

■  Tata  Consultancy  Services, 

which  provides  offshore  outsourcing 
services,  is  adding  what  it  calls  a 
safety  net  to  its  application  develop¬ 
ment  offerings.  The  consultancy  is 
partnering  with  iRise  to  add  iRise's 
Application  Simulator  technology  to 
its  list  of  services.  IRise  specializes  in 
providing  companies  with  tools  to 
look  at  and  review  applications 
before  a  single  line  of  code  is  written 
so  that  service  providers  and  cus¬ 
tomers  have  a  clear  understanding  of 
the  intended  result. 


Cingular  touts  mobile  e-mail  services 


■  BY  JIM  DUFFY 

Cingular  Wireless  last  week  launched  two 
enterprise-class  e-mail  services  designed  to 
let  users  securely  access  corporate  e-mail 
resources  from  mobile  devices. 

The  services  include  customer  premise- 
and  network-based  offerings  called  Xpress 
Mail  Enterprise  Edition  and  Xpress  Mail 
Network  Edition,  respectively.  They  are 
based  on  software  from  Seven  Networks,  a 
developer  of  mobile  e-mail  servers. 

Seven  has  a  relationship  with  Cingular 
and  supplies  comparable  products  to 
mobile  operators  such  as  KDDI,  Orange, 
NTT  DoCoMo,  02, SingTel  and  Sprint. 

Enterprise  Edition  puts  a  dedicated  wire 
less  mail  server  behind  the  corporate  fire 
wall  for  businesses  that  prefer  to  manage 
their  own  mobile  email  resources.  Net¬ 
work  Edition  is  a  managed  service  hosted 
by  Cingular  that  operates  behind  a  net- 


New  e-mail  service 

Cingular’s  Xpress  Mail 

Enterprise  Edition  and  Xpress 

Mail  Network  Edition  feature: 

•  Push-based  data  access  for 
Microsoft  Exchange,  Lotus  Domino, 
IMAP  and  POP  content. 

•  Customizable  synchronization 
scheduling  and  alerts. 

•  Multiple  in-boxes  from  the  same 
user  interface. 

•  Support  for  128-bit  AES,  SSL  and 
VPN  security. 

work-based  firewall. 

Network  Edition  is  designed  for  busi¬ 
nesses  that  do  not  want  to  own  or  manage 
the  technology  —  Cingular  manages  the 
service  from  its  data  center.  Once  a  busi¬ 


ness  chooses  between  the  behind-the-fire- 
wall  and  managed  service  options,  users 
can  be  set  up  centrally  by  IT  or  individual¬ 
ly  based  on  the  company’s  requirements. 

Each  service  also  features  reporting  tools 
to  monitor  usage  and  service. 

Both  services  are  designed  to  work  on  a 
variety  of  mobile  devices,  including 
palmOne’sTreo  600,  which  Cingular  offers. 
The  services  are  intended  to  be  “device¬ 
agnostic”  —  letting  multiple  wireless 
devices  securely  connect  to  multiple 
e-mail  platforms,  Cingular  says. 

“This  is  really  an  attempt  by  the  carriers 
to  offer  something  that  has  a  larger 
addressable  market  and  is  more  affordable 
than  BlackBerryf  says  Mark  Lowenstein, 
managing  director  of  wireless  consultancy 
Mobile  Ecosystem. “It’s  playing  off  the  suc¬ 
cess  of  BlackBerry  A  lot  of  people  want  a 
behind-the-firewall  enterprise  solution  to 
See  Cingular,  page  30 


VoIP  vendors:  Regulation  hinders  growth 


■  BY  GRANT  GROSS 

U.S.  regulators  can  play  an  important  role 
in  the  spread  of  VoIP  services  by  showing 
the  rest  of  the  world  that  the  best  way  to 
encourage  growth  is  by  limiting  regulation, 
according  to  those  who  sell  VoIP  services 
and  equipment. 

A  consistent  “light  touch”  approach  on 
regulation  throughout  the  U.S.,  European 
Union  and  other  countries  also  would  help 
VoIP  grow,  said  vendors  of  VoIP-related 
products  at  a  recent  FCC  forum  on  global 
IP  regulation  in  Washington,  D.C. 

Regulators  in  many  nations  still  question 
how  to  regulate  VoIP  services,  said  Jon¬ 
athan  Draluck,  vice  president  of  business 
affairs  and  general  counsel  for  iBasis,  a 
VoIP  service  provider. 

“Nothing  has  been  a  clearer  beacon  and 
signal  for  these  countries  and  these  regula¬ 
tors  than  to  hold  up  the  U.S.  as  an  exam¬ 
ple,”  he  said. “The  U.S.  has  had  a  light  regu¬ 
latory  touch, and  this  has  fueled, more  than 
anything,  the  innovation  and  the  growth  of 
this  industry’ 

The  six  vendors  seemed  united  in  their 
call  for  a  largely  hands-off  approach  to  reg¬ 
ulating  VoIRas  opposed  to  the  heavy  regu¬ 
lations  that  traditional  telephone  carriers 
face  from  the  FCC.  But  asked  if  regulation 
might  be  needed  if  competitors  such  as 


cable  companies  give  priority  to  their  own 
VoIP  products,  at  least  one  panelist  advo¬ 
cated  that  kind  of  regulation. 

If  cable  companies  gave  priority  to  their 
own  VoIP  packets  over  competitors’  prod¬ 
ucts, VoIP  providers  might  petition  the  FCC 
to  step  in,  said  Jeff  Pulver,  president  and 
CEO  of  Pulver.com,  provider  of  the  Free 
World  Dialup  VoIP  service.  “If  cable  opera¬ 
tors  or  other  operators  are  discriminating 
against  traffic, such  that  not  every  packet  is 
the  same  type  of  packet ...  if  that  could  be 
proven,  that’s  a  problem,”  Pulver  said. “I  do 
think  commercially  around  the  world,  we 
need  to  have  equal  and  fair  access.  Right 
now  it’s  not  regulated;  it’s  just  assumed  that 
everybody  plays  fair” 

But  Pulver  also  criticized  amendments  to 
a  U.S.Senate  bill  intended  to  keep  VoIP  free 
of  most  regulation.  In  July,  the  Senate 
Commerce,  Science  and  Transportation 
Committee  approved  the  VoIP  Regulatory 
Freedom  Act,  but  amended  it  to  allow 
states  to  require  VoIP  applications  to  pro¬ 
vide  911  services  and  to  require  VoIP 
providers  to  contribute  to  state  universal 
service  programs  and  to  pay  intrastate 
access  charges  to  other  telecom  providers. 

Others,  including  lawmakers  from  rural 
states  and  the  U.S.  Department  of  Justice, 
have  pushed  for  regulations.  Some  law¬ 
makers  in  rural  states  want  VoIP  to  con¬ 


tribute  to  the  Universal  Service  Fund, 
which  helps  fund  telecom  services  in  rural 
and  poor  areas.  Law  enforcement  officials 
want  wiretap  regulations  to  apply  to  VoIP 
and  traditional  telephone  calls. Some  tradi¬ 
tional  telephone  carriers  say  VoIP  should 
face  the  same  set  of  regulations  as  they  do. 

But  panelists  said  old  telecom  regula¬ 
tions  don’t  make  sense  for  IP  services, 
where  state  or  national  borders  do  not 
apply  VoIP  has  the  potential  to  break  down 
not  only  national  boundaries  but  bound¬ 
aries  between  devices  such  as  PCs,  PDAs 
and  telephones,  and  traditional  ways  of 
regulating  those  devices  no  longer  apply, 
said  A1  Safarikas,  vice  president  of  wireline 
networks  for  Nortel. 

“The  world’s  innovators  are  right  now 
working  on  devices  that  we  probably  can’t 
think  of  in  this  room  in  100  years,”  he  said. 
“IP  will  enable  that,  and  all  those  bound¬ 
aries  will  come  down.  [Regulatory]  limits 
and  boundaries  are  broken  by  technology” 

Gross  is  a  correspondent  with  the  IDG 
News  Service. 
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Middleware  is  Everywhere 


MIDDLEWARE  IS  IBM  SOFTWARE.  It’s  software  that 
automates  your  IT  systems  to  align  with  your  unique 
business  goals.  Open,  flexible,  end-to-end  solutions 
that  help  you  keep  up  with  customer  demands  on  your 
infrastructure.  It's  how  to  avoid  costly  interruptions  in 
service  and  fulfill  your  service  level  agreements.  It’s  how 
to  stay  on  top  of  your  game,  no  matter  what  size  you  are. 


1.  Star  footballer  heads  it  in  at  buzzer. 

2.  Fans  call  rival  fans  to  gloat. 

3. 300%  more  calls  flood  network. 

4.  IT  systems  sense  and  respond  instantly. 

5.  Telecom  scores  big  with  customers. 


Middleware  for  the  on  demand  world.  Learn  more  at  ibm.com/middleware/agility  JjJJJ  DEMAND  BUSINESS 
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Figuring  out 
information 
stewardship 


I’ve  been  doing  a  lot  of  work  these  days 
on  the  topic  of  “information  steward¬ 
ship.”  Essentially  this  is  the  discipline  of 
ensuring  that  a  company’s  data  is: 

•  Accurate  and  as  complete  as  possible. 
•  Appropriately  secured,  with  access 
granted  only  to  appropriate  parties. 

•  Auditable  and  compliant  with  pertinent 
privacy  and  disclosure  guidelines. 

•  Stored  on  the  most  appropriate  and 
effective  storage  mechanisms. 

•  Reliably  backed  up  and  available  in  the 
event  of  a  failure. 

The  formal  equation  expressed  here  is 
that  information  stewardship  equals  data 
quality  management  plus  information  pro¬ 
tection  plus  compliance  plus  information 
life-cycle  management  plus  disaster-recov¬ 
ery/business-continuity  planning  (that  is:  IS 
-  DQM  +  IP  +  C  +  ILM  +  DR/BCP). 

In  some  large  organizations,  information 
stewardship  is  the  single  biggest  issue.  For 
companies  that  have  grown  through  merg¬ 
ers  and  acquisitions,  or  are  consolidating 
data  centers,  implementing  effective  infor¬ 
mation  stewardship  is  mind-bogglingly 
challenging.“How  do  recognize  that  1  see  a 
customer  in  15  different  databases  in  10  or 
12  ways?”  asks  the  CTO  of  a  multibillion- 
dollar  health  services  organization. 

The  stakes  have  never  been  higher. 
Regulations  such  as  the  Health  Insurance 
Portability  and  Accountability  Act,  Gramm- 
Leach-Bliley  and  Sarbanes-Oxley  mandate 
information  accuracy  and  privacy  with  stiff 
penalties  for  non-compliance.  Moreover, 
the  cost  and  overhead  of  poor  information 
stewardship  is  equally  steep:  Critical  data 
that’s  necessary  to  manage  an  organiza¬ 
tion’s  day-to-day  operations  is  missing,  inac¬ 
curate  or  corrupt. 

Much  of  this  isn’t  exactly  news  —  IT  exec¬ 
utives  doubtlessly  have  wrestled  with  infor¬ 
mation  stewardship  issues  since  the  days 
of  the  ENIAC.  What’s  new,  though,  is  the 
degree  to  which  the  challenges  of  infor¬ 
mation  stewardship,  and  many  emerging 
telecom  technologies  intersect. 

For  starters,  telecom  companies  are 
among  the  companies  facing  acute  infor¬ 
mation  stewardship  challenges.  For  many 
telcos, simply  finding  out  what  information 
resides  in  which  database  is  a  significant 
challenge.  Additionally,  telcos  such  as  MCI 
that  were  formed  from  the  merger  of 
dozens  of  smaller  companies  have  cus¬ 
tomer  data  distributed  among  dozens  of 


incompatible  databases.  (That’s  one  rea¬ 
son  your  phone  company  can’t  get  your 
bill  correct.)  Phone  companies  are  there¬ 
fore  among  the  most  sophisticated  con¬ 
sumers  of  data  quality  management,  which 
as  noted  is  a  key  component  of  informa¬ 
tion  stewardship. 

Even  more  intriguingly  telecom  is  a  criti¬ 
cal  element  that  enables  other  aspects  of 
information  stewardship.  Information  is 
increasingly  stored  (at  least  in  part)  offsite, 
which  means  that  providing  an  effective, 
secure,  reliable  circuit  to  that  stored  infor¬ 
mation  is  critical. 

Most  telcos  are  just  beginning  to  under¬ 
stand  both  the  issues  and  the  roles  their 
services  can  play  In  the  late  1990s  there 
was  a  boomlet  of  “online  storage”  as  com¬ 
panies  such  as  Giant  Loop  envisioned  that 
companies  soon  would  begin  storing  their 
data  “in  the  cloud.”  A  small  problem  was 
that  most  companies  understandably  don’t 
want  to  park  critical  data  with  a  telco  that 
can’t  even  create  accurate  bills.  As  a  result, 
the  services  failed,  which  many  interpreted 
to  mean  that  telcos  had  no  information 
stewardship  role. 

That  perspective’s  equally  shortsighted: 
Networking  is  a  critical  component  of  the 
information  stewardship  equation.  To  see 
how,  stay  tuned. 

Johnson  is  president  and  chief  research 
officer  at  Nemertes  Research,  an  indepen¬ 
dent  technology  research  firm.  She  can  be 
reached  at  johna@nemertes.com. 


Cingular 

continued  from  page  27 

access  mobile  e-mail  but  on  a  much 
broader  variety  of  devices  —  the 
BlackBerry  experience  on  any  mobile 
device.” 

Cingular  also  supports  750,000  Black- 
Berry  users,  Lowenstein  says. 

“Cingular  has  made  some  big  bets 
around  applications  that  they  are  empha¬ 
sizing,”  he  says.“Messaging  is  one.” 

Both  editions  use  common  security  and 
encryption  technologies  such  as  128-bit 
Advanced  Encryption  Standard,  Secure 
Sockets  Layer  and  VPN.  They  also  include 
features  such  as  push-based,  real-time 
access  to  data  on  Microsoft  Exchange, 
Lotus  Domino,  Internet  Message  Access 
Protocol  and  POP  servers;  customizable 
synchronization  schedules  and  alerts;  and 
access  to  multiple  e-mail  in-boxes  and 
accounts  from  the  same  user  interface. 

The  services  provide  global  access  so 
users  can  securely  check  their  e-mail  from 
any  browser.  Also,  data  is  never  replicated 
to  third-party  servers  outside  the  firewall. 

Enterprise  Edition  and  Network  Edition 
are  available  now  on  palmOne’s  Treo  600 
handheld  wireless  device.  Airtime  is  $30 
per  user,  per  month,  including  5M  bytes  of 
data  usage,  or  $40  per  user,  per  month, 
including  unlimited  data  usage. 

Enterprise  Edition  requires  a  onetime 
setup  and  installation  fee  of  $1,500,  and  a 
onetime  connection  fee  of  $1 ,000.  ■ 


Get  your  FREE  book  and  learn  how  your 
company  can  manage  the  startling  growth 
in  email  volume — and  withstand  the 
massive  flood  of  spam,  viruses  and  fraud  that 
threaten  your  email  communication  system. 


To  order  your  free  copy  of 
GET  THE  MESSAGE: 

A  Business  Guide  to 
Surviving  the  Email  Security  Crisis, 
visit  www.ironport.com/book 
or  call  toll  free  866.882.8658 
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Remote  optimizers  aid  consolidation 


HOW  IT  WORKS 


Remote-office 

optimizer 


Remote-office  optimizer 

A  remote-office  optimization  appliance  enables  server 
consolidation  by  providing  real-time  access  to 
centralized  resources. 
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O  User  requests  a  file,  which  has  been  previously  saved,  from  a  virtual 
server  on  the  remote-office  optimizer. 

©  The  remote-office  optimizer  relays  the  request  to  the  data-center 
optimizer  for  processing. 

©  The  data-center  optimizer  requests  the  file  from  the  actual,  or  central,  file  server,  performing 
authentication  and  access  rights  verification  just  as  if  the  client  communicated  directly  with 
the  central  file  server. 

O  The  central  file  server  grants  the  data-center  optimizer  access  to  the  file.  The  data-center 
optimizer  examines  the  file  to  see  if  any  changes  have  been  made. 

©  If  the  file  was  modified,  the  data-center  optimizer  extracts  and  compresses  the  changes  to 
send  to  the  remote-office  optimizer. 

©  The  remote-office  optimizer  updates  the  file  in  its  records  if  changes  have  occurred  and  delivers 
the  file  to  the  user. 


■  BY  YUVAL  HAGER 

Organizations  with  branch  offices  are 
consolidating  their  networks  to  control 
the  costs  of  managing  their  IT  infrastruc¬ 
tures.  But  because  of  latency  posed  by 
WAN  connections,  it’s  difficult  to  provide 
remote-site  users  with  the  network  perfor¬ 
mance  they  require  while  ensuring  the 
integrity  of  centralized  data. 

Remote-office  optimization  appliances 
circumvent  these  challenges  by  enabling 
real-time  access  of  data  over  WANs.This  is 
accomplished  by  combining  optimiza¬ 
tion  techniques  such  as  compression, 
dynamic  caching,  binary  delta  calcula¬ 
tion  and  transaction  aggregation.  By 
deploying  remote-office  optimizers,  orga¬ 
nizations  can  offer  their  users  real-time, 
synchronous  access  to  centralized  re¬ 
sources,  ensuring  the  integrity  and  co¬ 
herency  of  organizational  data  and  user 
productivity  levels  at  branch  offices. 

Dual  optimization 

A  remote-optimizer  appliance  is  installed 
at  each  branch  and  in  the  corporate  data 
center.  Because  the  solution  must  be  bidi¬ 
rectional,  optimizing  traffic  to  and  from  a 
data  center  and  remote-branch  offices, 
devices  are  required  in  both. 

A  remote-office  optimizer  in  a  branch 
office  optimizes  traffic  flowing  to  a  data 
center,  and  a  remote-office  optimizer  in  a 
data  center  —  also  called  a  data  center 
optimizer  —  optimizes  traffic  to  remote 
branch  offices. 

Once  the  remote-office  optimizers  are 
installed,  administrators  can  centralize  all 
organizational  data  at  their  data  centers 
or  headquarters.  At  the  same  time,  file 
servers,  storage  and  back-up  resources 


can  be  removed  from  branches.  To  pro¬ 
vide  branch-office  users  with  experiences 
comparable  to  working  with  local  file 
servers  at  headquarters,  remote-office 
optimizer  appliances  facilitate  the  re¬ 
trieval  and  saving  of  data  over  WANs. 

When  the  remote  user  saves  a  file  it  is 
forwarded  to  the  data  center  and  saved  to 
the  central  file  server. The  file  also  is  saved 
to  the  remote-office  optimizer’s  virtual 
server.  Upon  notification  of  the  save  from 
the  central  file  server,  the  data  center  opti¬ 
mizer  notifies  the  remote-office  optimizer, 


which  notifies  the  client.  All  messages  and 
notices  are  issued  by  the  data  center  opti¬ 
mizer,  not  the  remote-office  optimizer. 

When  the  user  saves  changes  to  the  file, 
the  remote-office  optimizer  compares  the 
new  file  with  the  previously  saved  file. 
Only  the  changes  from  the  previously 
saved  file,  the  delta,  is  sent  across  the 
WAN.  When  other  users  in  the  branch 
access  the  same  file,  they  are  served  by 
the  remote-office  optimizer. 

If  the  file  was  changed,  the  delta  is  sent 
by  the  device  in  the  data  center,  which 


knows  the  state  of  the  file  on  the  branch 
device.  The  record  on  the  remote-office 
optimizer  is  updated  with  the  deltas  as  it 
serves  the  file  to  the  user.  Subsequent 
changes  will  be  compared  with  this  up¬ 
dated  record. 

In  addition  to  reducing  traffic  by  trans¬ 
ferring  only  deltas  and  optimizing  all  for¬ 
warded  traffic,  remote-office  optimizers 
apply  application-level  optimization  for 
certain  protocols  and  for  a  file  system 
itself,  circumventing  WAN  latency  exacer¬ 
bated  by  chatty  protocols. 

Because  remote-office  optimizers  oper¬ 
ate  synchronously  network  administrators 
enjoy  a  high  degree  of  control  over  their 
distributed  networks.They  can  boost  secu¬ 
rity  by  enforcing  authentication,  authoriza¬ 
tion  and  auditing  from  their  data  centers. 

Also,  because  all  corporate  data  is  cen¬ 
trally  located,  the  deployment  of  security 
storage  and  back-up  devices  is  signifi¬ 
cantly  simplified,  as  are  the  formulation  of 
disaster-recovery  protocols.  Because  there 
is  no  critical  data  in  the  branches,  there  is 
no  need  for  storage,  backup  or  the  strictest 
security  measures  at  those  locations. 

In  addition  to  letting  organizations  con¬ 
solidate  resources  across  their  distributed 
networks,  remote-office  optimizers  enable 
consolidation  within  each  branch  office. 
They  provide  print,  DNS,  Dynamic  Host 
Configuration  Protocol  and  other  server 
functions. 

Use  of  a  remote-office  optimizer  helps 
companies  reduce  capital  and  opera¬ 
tional  costs  of  implementing  and  main¬ 
taining  remote-office  IT  infrastructure. 

Hager  is  founder  and  vice  president  of 
research  and  development  of  DiskSites.  He 
can  be  reached  at  yuval@disksites.com. 


Dr.  Intefnet  By  Steve  Blass 

We're  trying  to  implement  streaming  audio  and 
video  with  NetMeeting  on  Windows  XP  Profession¬ 
al.  We're  using  a  USB  camera  that  works  well  with 
the  software  it  came  with,  but  with  NetMeeting  the 
video  being  sent  shows  only  a  black  screen.  Turn¬ 
ing  off  the  desktop  firewalls  didn't  help.  Any  ideas? 

Setting  XP  QoS  RSVP  to  manual  in  the  Control 
Panel/Administrative  Tools/Services  applet  might 
fix  it  so  the  sound  and  video  will  work,  depending 


on  how  you  have  configured  the  rest  of  your  XP 
network  settings.  Also  try  lowering  the  screen  res¬ 
olution  on  the  receiving  computer(s)  to  800  by  600 
pixels  to  better  accommodate  the  video  being 
received.  In  order  to  receive  incoming  NetMeeting 
calls,  the  desktop  firewall  must  allow  traffic  on 
TCP  ports  1503  and  1720.  Disabling  the  firewall  is 
one  way  to  open  the  ports  during  a  meeting.  A 
good  resource  for  troubleshooting  NetMeeting  on 
XP  is  available  at  www.nwfusion.com,  DocFinder: 


3234,  where  you  can  find  information  and  pointers 
on  using  NetMeeting  with  newer  cameras  that 
use  Windows  Digital  Media  driver  software  rather 
than  Video  For  Windows  drivers.  Some  camera 
vendors  also  provide  downloadable  drivers  to  help 
solve  the  problem. 

Blass  is  a  network  architect  at  Change@Work  in 
Houston.  He  can  be  reached  at  dr.internet@changeat 
work.com. 


www.nwfusion.com 
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Technology  Update 


Power  line  to  the  people 


GEARHEAD 
INSIDE  THE 
NETWORK 
MACHINE 

Mark 

Gibbs 


Last  week  we  discussed  the  delights  of 
power-line  networking  based  on  the 
HomePlug  standard. 

HomePlug  nodes  can  communicate  at 
up  to  14M  bit/sec.  Note  that  we  wrote  “can” 
and  “up  to”  —  anything  that  degrades  the 
signal, such  as  interference  and  gremlins  or 
more  than  16  HomePlug  devices,  will 
cause  the  power-line  system  to  back  off  to 
find  a  reliable  throughput  rate. 

You’ll  find  that  each  node  pair  in  a 
HomePlug  network  likely  will  connect  at 
different  data  rates  because  each  individ¬ 
ual  path  across  the  power  lines  will  have 
different  transmission  characteristics. 

Actually,  the  maximum  of  16  devices  is 
the  figure  most  vendors  quote,  but  a  paper 
from  the  Massachusetts  Institute  of  Tech¬ 
nology,  “Moving  HomePlug  to  Industrial 
Applications  with  Powerline  Communi¬ 
cation  Network”  (www.nwfusion.com, 
DocFinder:  3230),  says  that  for  best  perfor¬ 
mance  you  should  network  only  up  to  15 
nodes  using  the  HomePlug  1.0  standard. 


So,  what  are  the  limitations  other  than  the 
number  of  devices?  First,  distance:  Home- 
Plug  signals  will  travel  a  maximum  of 
about  300  meters  of  wire,  notwithstanding 
interference  from  electric  motors,  fluores¬ 
cent  lights, halogen  lamps, switching  power 
supplies  and  dimmer  switches.  You  also 
should  avoid  connecting  HomePlug 
devices  to  power  sockets  using  extension 
cables  and  multi-outlet  power  strips  with 
surge  suppressors. 

There  also  are  wiring  limitations.  While 
HomePlug  signals  have  no  problem  pass¬ 
ing  through  circuit  breakers,  they  won’t 
pass  through  power  transformers  and  will 
not  reliably  cross  phases. 

This  latter  issue  is  not  that  bad  in  prac¬ 
tice.  In  a  report  titled  “HomePlug  1.0  pow¬ 
erline  communication  LANs  —  protocol 
description  and  performance  results”  pub¬ 
lished  in  the  International  Journal  of  Com¬ 
munication  Systems  (DocFinder:  3231),  the 
authors  note  that:  “Despite  these  impedi¬ 
ments,  tests  of  the  present  version  of  the 
HomePlug  1.0  power-line  devices  in  some 
500  homes  show  that  80%  of  outlet  pairs 
will  be  able  to  communicate  with  each 
other  at  about  5M  bit/sec  or  higher,  and 
98%  will  be  able  to  support  data  rates 
greater  than  1M  bit/sec:  Field  tests  suggest 
that  the  power-line  network  will  provide 


connectivity  in  situations  where  some  wire¬ 
less  networks  will  fail  due  to  large  attenua¬ 
tions  caused  by  distance  or  obstructions 
such  as  intervening  walls  or  furniture.” 

Also  check  out  the  paper  “HomePlug 
Field  Test  Results:  A  White  Paper” 
(DocFinder:  3232)  issued  by  the  HomePlug 
Powerline  Alliance. 

An  important  issue  with  HomePlug  is  pri¬ 
vacy  HomePlug  signals  can  “escape"  from 
your  power  wiring  and  be  picked  up  by 
your  neighbors.  To  get  around  this,  Home- 
Plug  provides  data  security  based  on  56-bit 
DES  encryption. 

Using  a  vendor-supplied  utility  you 
enable  encryption  by  setting  a  password 
into  each  HomePlug  transceiver  —  all 
devices  that  are  to  communicate  must  use 
this  password. 

In  our  tests  of  Netgear  and  Linksys  prod¬ 
ucts,  we  found  that  HomePlug  technology 
works  amazingly  well.  As  we  noted  last 
week,  all  the  products  were  easy  to  install 
but  the  documentation  and  management 
utilities  could  be  improved.  We  found  the 
utilities  were  inconsistent  in  detecting  the 
transceivers,  which  could  not  be  easily 
explained  because  when  they  were  found 
the  connections  were  considered  good  or 
excellent. 

That  snafu  aside,  we  had  no 


problem  getting  reliable  connections 
between  transceivers.  Indeed,  we  are 
hooked.  Power-line  networking  is  a  pow¬ 
erful  tool  to  have  in  your  “we  need  a 
quick  connection  for  a  reasonable  price” 
tool  box. 

The  International  Journal  of  Communica¬ 
tion  Systems  report  we  mentioned  earlier 
concludes  with:“In-home  [power-line  com¬ 
munications]  have  the  potential  for  signifi¬ 
cant  improvements.  .  .  .  The  HomePlug 
Fbwerline  Alliance  announced  plans  for 
the  development  of  next-generation  pow¬ 
erline  specifications  . . .  called  HomePlug 
AV  .  .  .  intended  to  provide  100M  bit/sec 
throughput,  and  will  be  designed  to  sup¬ 
port  distribution  of  data  and  multi-stream¬ 
ing  entertainment,  including  high  defini¬ 
tion  television  and  standard  definition  tele 
vision,  throughout  the  home.” 

The  HomePlug  AV  specification  has 
moved  forward  reasonably  quickly,  and 
the  HomePlug  Powerline  Alliance  note  on 
their  Web  site  (DocFinder:  3233)  that 
“HomePlug  AV  products  will  likely  be 
available  for  the  2004  holiday  season.”  We 
know  what  we  want  for  Christmas. 

So  tell  us  your  home  networking  tales  — 
best  response  by  the  1 6th  gets  a  rosebush. 
Entries  to  gearhead@gibbs.com. 


Cool 


Quick  takes 
on  high-tech  toys 

By  Keith  Shaw 


D-Link's 
Internet  Security 
Camera  captures  video 
at  up  to  30  frames/sec 
at  VGA  resolution. 


D-Link  launches  802.1 lg 
network  camera 

D-Link  Systems  last  week 
announced  an  802.1  lg 
wireless  LAN-based  net¬ 
work  camera  that  in¬ 
cludes  remote  pan,  tilt 
and  zoom  features. 

The  D-Link  Wireless 
Internet  Security  Camera 
(Model  DCS-5300G)  is  the 
latest  in  D-Link’s  Securi- 
Cam  Network  line  of  net¬ 
work  cameras,  which  let 
users  view  camera  images 
remotely  on  the  Internet 
via  a  Web  browser. 

The  camera  connects  to  a  network  over  802. 1  lg  wireless 
or  Ethernet  and  supports  up  to  30  frames  per  second  at  up 
to  640-by-480-pixel  resolution  with  MPEG-4  video  com¬ 
pression.  Tfie  Charge  Coupled  Device  sensor  helps  in  low- 
light  situations,  and  a  microphone  is  integrated  so  users 
can  hear  what  the  camera  is  watching.  Users  can  control 
the  view  through  its  pan  (270-degree),  tilt  (90-degree)  or 
4x-digital  zoom  features. 

Security  features  such  as  Service  Set  Identifier  (SSID)  fil- 


Print  onto  a  CD  or  DVD 
directly  with  Primera’s 
Signature  Z1. 


tering,  and  64-  and  128-bit 
Wired  Equivalent  Privacy 
(WEP)  encryption  are 
included.  The  camera 
costs  about  $550  and  is 
scheduled  to  be  available 
later  this  month. 


Primera  introduces 
CD/DVD  printer 

Primera  Technology  has 
introduced  a  printer  that  can 
print  directly  onto  a  CD  or  DVD.  The  $140 
Signature  Z1  is  geared  toward  home  and  office 
users,  and  is  available  now. 

The  Signature  Z1  prints  on  up  to  four  different 
areas,  or  quadrants,  of  a  disc  by  having  the 
device  spin  the  disk  and  then  apply  the  ink  in 
that  quadrant.  Primera  says  it  takes  less  than  1 
minute  to  print  to  a  disc. The  device  connects  to  any 
PC  with  Windows  2000  or  XP  via  USB  cables.  Label 
design  software  is  included.The  ribbon  for  the  printer  can 
produce  about  100  discs  (in  cases  where  all  four  quad¬ 
rants  are  used)  before  it  needs  replacement. 

Have  access  point,  will  travel 

SMC  Networks  has  announced  its  EZ  Connect  Traveler’s 
Kit, a  travel-ready  802.1  lg  wireless  access  point, USB  cable, 
Ethernet  cable  and  power  cord. The  $100  kit  will  be  avail¬ 
able  by  the  end  of  August,  SMC  says. 

The  Traveler’s  Kit  (Model  SMCWTK-G)  includes  a  net¬ 
work  device  that  can  operate  in  five  modes:  access  point, 
Ethernet  bridge,  repeater,  point-to-point  bridge  or  point-to- 
multipoint  bridge. For  users  on  the  road  or  those  visiting  an 
office,  the  device  connects  to  a  wired  Ethernet  port  and 
then  can  provide  wireless  connectivity  for  other  users.  As 
an  Ethernet  bridge,  the  device  connects  to  any  device  with 
an  Ethernet  port  (such  as  a  gaming  console  or  printer) 


and  makes  it  wireless.  As  a  repeater.it  can  help 
extend  the  range  of  an  existing  wireless  net¬ 
work. 

Security  features  include  support  for 
64- and  128-bit  WERWi-Fi  Protected  Ac¬ 
cess,  media  access  control  address  fil¬ 
tering  and  the  ability  to  disable  SSID 
broadcasts. 


Create  your  own  movie  theater 

InFocus  has  launched  a  consumer-focused 
projector  that  can  project  high-definition 
images.  The  ScreenPlay  5000  costs  about  $2,000  and  can 
project  images  up  to  1 1  feet  wide,  the  company  says. 

The  7.5-pound  ScreenPlay  5000  connects  to  a  home  elec¬ 
tronics  device  (such  as  a  DVD  player,  satellite  receiver,  or 
high-definition  cable  or  satellite  receiver). The  device  sup¬ 
ports  a  16:9  aspect  ratio,  and  has  1,100  lumens  of  bright¬ 
ness  and  a  1,200:1  con¬ 
trast  — “ a— —  — — 


The  ScreenPlay  5000  lets 
you  project  movies  onto 
screens  as  large  as  11  feet 
wide. 


inFocus 


ratio.  It 

supports  digital  video 
inputs,  and  has  automatic  keystone 
shape  correction  capabilities. The  device  comes  with  a  12- 
volt  screen  trigger,  which  can  be  used  to  automatically 
raise  or  lower  an  electronic  screen. 

Shaw  can  be  reached  at  kshaw@nww.com 
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Vortex  1 2004 


Executive  Producers 


GEOFFREY  MOORE 

Managing  Director 
TCG  Advisors  LLC 

Acclaimed  author  of  Crossing  the 
Chasm  and  Inside  the  Tornado 


JOHN  GALLANT 

President  &  Editorial  Director 
Network  World 


VORTEX  2004:  SETTING  THE  IT  AGENDA  is  an  interactive  experience  showcasing  a  diversity  of  informed 
opinion  and  fresh  insights  on  the  future  of  the  nearly  $1  trillion  enterprise  IT  market.  VORTEX  is  an  immersive 
dialogue  among  chief  executives,  chief  information  officers,  leading  analysts  and  investors  on  issues  including: 

■  What  shape  will  the  post-client/server  IT  world  take? 

■  How  are  leading  vendors  like  IBM,  Microsoft,  Oracle,  SAP,  EMC,  HP,  Cisco,  and  others  positioning 
themselves  for  market  dominance  and  what  opportunities  are  created  for  innovators? 

■  Are  vendors  and  IT  executives  in  sync  on  key  issues  and  directions? 

■  How  can  early  adopters  create  competitive  advantage? 

Through  a  series  of  frank  one-on-one  interviews,  engaging  Q&A’s  and  spirited  panel  discussions,  John  Gallant  and 
Geoffrey  Moore  will  analyze  diverging  vendor  strategies  and  compare  their  visions  with  the  current  needs  of  IT. 
All  to  help  you  determine  what  you  need  to  design  and  buy  for  your  enterprise  to  prosper. 


For  more  information  and  to  register,  visit  www.vortex.net/V4A3S  or  call  800-643-4668 


SOME  OF  THE  SPEAKERS  YOU'LL  HEAR  FROM  AT  VORTEX  2004  INCLUDE: 


Shai  Agassi  Member  of  the  Executive  Board,  SAP  AG  ■  Dr.  Francine  Berman  Director,  San  Diego  Supercomputer  Center  ■  Jeffrey  Blumenfeld  Partner,  Antitrust 
and  Intellectual  Property,  Crowell  &  Moring  LLP  •  Howard  Elias  EVP,  Corporate  Marketing  &  Office  of  Technology,  EMC  Corporation  ■  John  Gantz  SVP  &  Chief 
Research  Officer,  IDC  ■  Umang  Gupta  Chairman  &  CEO,  Keynote  Systems  ■  John  Hagel  Management  Consultant  &  Author  •  Donald  A.  Haile  CIO,  Fidelity 
Investments  Systems  Company  •  Steve  R.  Hanna  Information  Officer,  Global  Sales,  Services  &  Marketing,  GM  IS  &  S,  General  Motors  ■  Sam  Jadallah  General 
Partner,  Mohr  Davidow  Ventures  ■  Mitchell  Kertzman  Partner,  Hummer  Winblad  Venture  Partners  ■  David  Kirkpatrick  Senior  Editor,  Internet  &  Technology,  Fortune 
Magazine  •  Scott  Kriens  Chairman  &  CEO,  Juniper  Networks  ■  John  Landry  Chairman  &  CTO,  Adesso  Systems,  Inc  ■  Dan'l  Lewin  Corporate  Vice  President, 
Business  Development,  DPE  Division,  Microsoft  Corporation  •  Christopher  Lynch  President  &  CEO,  Acopia  Networks  ■  Marten  Mickos  CEO,  MySQL  AB  • 
L.  David  Passmore  Research  Director,  Network  and  Telecom  Strategies,  The  Burton  Group  *  Charles  E.  Phillips,  Jr.  President  &  Member  of  the  Board,  Oracle 
Corporation  •  Ron  Ponder  Executive  VP  &  CIO,  WellPoint  •  Shane  V.  Robison  EVP,  Chief  Strategy  &  Technology  Officer,  Hewlett-Packard  ■  Joe  Schoendorf 
Partner,  Accel  Partners  •  Jonathan  Schwartz  President  &  COO,  Sun  Microsystems  •  Stratton  Sclavos  Chairman  &  CEO,  VeriSign  •  Steven  Silberstein  Managing 
Director,  Lehman  Brothers  ■  Peter  Solvik  Managing  Director,  Sigma  Partners  ■  Mike  Volpi  SVP  &  General  Manager,  Routing  Technology  Group,  Cisco  Systems, 
Inc.  ■  Irving  Wladawsky-Berger  VP,  Technology  &  Strategy,  IBM  Corporation 
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ON  TECHNOLOGY 

John  Dix 


jgj  s  the  collapse  of  CeBIT  America  last  week,  six  weeks 
n  after  the  announcement  that  Comdex  was  canceled 
IE  for  2004,  all  the  evidence  we  need  to  conclude  there 
is  no  longer  a  need  for  big,  general-purpose  computing 
conferences? 

CeBIT  America,  which  just  staged  its  second  U.S.show  in 
June  in  New  York,  hoped  to  mimic  here  the  enormous 
success  CeBIT  has  enjoyed  in  Germany. The  Hannover, 
Germany,  show  this  spring  lasted  six  days,  hosted  6,400 
exhibiting  companies  in  3.6  million  square  feet  of  display 
space  and  attracted  more  than  500,000  attendees. 

Even  in  its  glory  days  Comdex  only  achieved  half  that. 

When  it  was  first  eyeballing  the  U.S.  in  2002  the  CeBIT 
show  organizers  believed  they  could  establish  a  beach¬ 
head  here  because:  1)  Comdex  was  already  on  the  ropes 
and  CeBIT  reasoned  it  would  be  the  obvious  alternative 
when  the  market  bounced  back;  2)  Comdex  had  lost  its 
focus  and  the  U.S.  was  ready  for  a  dedicated  enterprise  IT 
event;  and  3)  CeBITs  focus  on  what  the  organizers  called 
Information  &  Communications  Technology  (ICT)  was  a 
differentiator. 

The  writing  was  indeed  on  the  wall  for  Comdex  in  2002 
and  the  “be  all  things  to  all  people”  nature  of  Comdex  left 
it  vulnerable  to  a  show  like  CeBIT  that  focused  strictly  on 
enterprise  IT.  But  the  ICT  thing?  Every  show  from  Comdex 
to  NetWorld+Interop  to  Comnet  has  been  beating  this 
drum  for  years,  so  one  of  the  company’s  purported  differ¬ 
entiators  was  simply  more  of  the  same  old  stuff. 

Most  importantly,  instead  of  the  market  bouncing  back  it 
went  from  bad  to  worse.  Comdex  continued  to  lose 
exhibitors  and  attendees,  and  by  February  2003  show 
owner  Key3Media  Group  filed  for  bankruptcy  Key3  came 
out  of  bankruptcy  in  June  of  that  year,  the  same  month 
CeBIT  America  launched  in  New  York. 

But  CeBIT  never  really  got  out  of  the  gates.The  first 
show  attracted  only  8,500  attendees  instead  of  the  20,000 
envisioned,  and  the  second  show  in  May  was  anemic. 
Even  one  keynoter  —  Thomas  Siebel,  CEO  of  Siebel 
Systems  —  blew  it  off,  sending  a  stand-in  at  the  last 
minute. 

So  it  would  appear  the  world  doesn’t  need  generic  com¬ 
puter  trade  shows  any  more.  Computing  vendors  seem 
content  to  reach  customers  with  online  tools  like  e-mail 
and  Webcasts.  It  would  be  a  shame,  however,  if  that  is  all 
we’re  left  with.  Conferences  let  the  buyer  get  a  taste  of  new 
technologies,  meet  many  companies  in  a  short  amount  of 
time,  learn,  and  rub  elbows  with  industry  colleagues. 

Maybe  it’s  time  for  NetWorld+Interop  to  encompass 
more  computing  topics. 


Computing 
show  deaths 
leave  void 


—  John  Dix 
Editor  in  chief 
jdix@nww.com 
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opinions 


Telling  it  like  it  is 

Rock  on,  Denny  Strigl.  In  “Wireless  directory  draws 
cheers,  jeers”  (www.nwfusion.com,  DocFinder: 
3222),  the  Verizon  Wireless  CEO  is  quoted  as  saying, 
“Let’s,  as  an  industry  stop  pushing  something  on  cus¬ 
tomers  that  they  clearly  don’t  want.  It’s  a  dumb  idea.” 
I’m  glad  that  I’m  a  customer  of  a  company  like 
Verizon  with  a  CEO  that  not  only  isn’t  going  to  pub¬ 
lish  my  number,  but  actually  stood  up  to  his  peers  in 
the  industry  by  calling  a  spade  a  spade. 

Charles  O’Halloran 
Vice  president  of  operations 
Engineered  Business  Systems 
Boca  Raton,  Fla. 

Yes  to  ad  blocking 

Regarding  Mark  Gibbs’  Backspin  column  “Adverts 
No,  blocking  Yes”  (DocFinder:  3223):  It  seems  that 
Internet  marketer  Stephen  Mahaney  has  a  serious 
problem. 

When  I  get  onto  the  ’Net,  it’s  for  a  reason.  If  an  ad  is 
stored  on  my  PC  and  suddenly  appears  when  I  don’t 
want  it  to,  that’s  an  invasion  of  privacy  Companies 
are  using  cookies,  spyware  and  anything  else  they 
can  find  that  will  get  their  propaganda  into  my  PC, 
and  if  they’re  lucky  in  front  of  my  eyes. 

If  Mahaney  wants  to  complain  that  he  should  have 
a  right  to  show  me  his  ads,  I  will  counter  with  my 
right  to  privacy 

Norris  Mantooth 
CIO 

Norris3.com 
Plano, Texas 

These  Internet  marketers  are  two-faced.They  don’t 
like  the  fact  that  Norton  turns  on  ad  blocking  with- 

E-mail  letters  to  jdix@nww.com  or  send  them  to  John  Dix,  editor  in 
chief.  Network  World,  1 18  Turnpike  Road,  Southborough,  MA  01 772. 
Please  include  phone  number  and  address  for  verification. 


out  giving  users  an  option  at  install  or  upon  the  first 
block  that  lets  them  choose  to  use  it.  However,  the 
marketers’  own  pop-ups  never  give  users  a  choice  to 
say  yes  or  no  to  ever  seeing  any  of  their  ads  again. 
They  should  live  by  their  own  supposed  code  of 
ethics  and  the  first  pop-up  should  give  users  the 
chance  to  say“Nevershow  me  another  pop-up  from 
this  domain.” 

Chuck  Johnson 
Kokomo,  Ind. 

Stephen  Mahaney  will  gain  no  sympathy  from  me 
as  long  as  he  and  his  breed  continue  to  barrage  my 
computer  with  unsolicited  commercial  drivel.  1  pay 
hard-earned  money  to  connect  to  the  Internet,  and 
I  find  it  astonishing  he  feels  he  has  the  right  to  con¬ 
sume  my  bandwidth  to  tell  me  something  I  don’t 
want  to  hear. 

While  I  agree  that  Norton  should  be  more  open 
about  what  the  product  is  doing,  the  majority  of  peo¬ 
ple  who  purchase  the  package  will  find  this  option 
useful. 

Weat  Mattis 
Technical  support  analyst 
Ingersoll-Rand  Industrial  Solutions 
Davidson,  N.C. 

I  suspect  there  might  be  an  issue  of  semantics 
here.  I  imagine  most  of  the  IT-elligentsia  consider 
ad  blocking  to  be  an  integral  part  of  a  firewall  and, 
therefore,  expect  all  firewalls  to  block  ads. 
Considering  the  malware  threats  contained  in  pop- 
ups,  I  don’t  disagree. 

On  the  other  hand,  one  could  make  a  case  that  ad 
blocking  and  firewalling  are  separate  issues.  In  cer¬ 
tain  circumstances,  1  can  see  wanting  to  have  fire¬ 
wall  capabilities  but  without  ad  blocking.  I  guess  the 
perspective  depends  on  which  side  of  the  fence 
begets  your  revenue:  ads  or  security 

Clinton  Troutman 
Fort  Worth, Texas 


More  online!  www.nwfusion.com  Find  out  what  readers  are  saying  about  these  and  other  topics.  DocFinder  3221 
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DEMO  INSIGHTS 

Chris  Shipley 


Moving  to  service-based  computing 


Last  year,  as  Demomobile  2003  was  near¬ 
ing,  I  developed  a  mantra  of  sorts.  As 
often  as  I  could,  I  asserted  that  mobile 
technology  had  turned  us  into  “always-on 
people” —  empowered  buyers  of  technology 
who  would  usher  in  a  new  era  of  “device 
computing,”  in  which 
computing  would  shift  from  desktop  and  laptop 
PCs  to  smart  phones  and  handheld  devices  that 
can  access  data  anytime,  anywhere.  Now,  a  year 
later,  1  think  1  was  right, even  if  I  did  have  it  backward. 

The  computing  shift  isn’t  about  hardware  devices,  as  I  initially 
thought.  It’s  about  the  software  architectures  that  support  those  tools. 
Rather  than  device  computing,  we’re  moving  to  an  age  of  service-deliv¬ 
ered  computing.  In  this  model,  service  providers  —  whether  applica¬ 
tion  service  providers  (ASP), corporate  IT  organizations  or  even  a  desk¬ 
top  computer  you  manage  yourself  —  make  applications  and  data 
available  to  individuals  who  connect  to  these  services  through  a  vari¬ 
ety  of  secure  devices. 

Certainly,  we  can  understand  and  accept  this  trend  in  the  form  of 
managed  software  services  —  ASPs  such  as  Salesforce.com  or 
NetLedger.  Enterprise  IT  has  opened  centralized  applications  to  data 
input  from  and  reporting  to  mobile  workers,  and  now  enterprise  appli¬ 
cations  are  being  architected  with  mobility  integrated  in  the  business 
process. 

You  can  see  the  next  ripple  in  this  spreading  paradigm  in  data  ser¬ 
vices  offered  to  mobile  phone  users.  As  higher  broadband  wireless  net- 
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works  come  online,  carriers  will  offer  a  range  of  data  services  that  go 
well  beyond  news,  traffic  and  weather.  Carriers  have  a  huge  and  virtu¬ 
ally  untapped  opportunity  to  become  the  data  center  for  their  mobile 
wireless  customers. 

The  ripples  will  extend  even  further,  as  presaged  by  AllenPort,  a 
Philadelphia  start-up  that  in  February  at  Demo  2004  introduced  a  ser¬ 
vice-based  computing  architecture,  in  which  ap¬ 
plications,  configuration  information,  data  and 
even  Web  history  and  bookmarks  are  stored  on  a 
central  service.  The  company  is  finding  traction 
with  broadband  network  operators  that  see  the  low-cost  hardware, 
high-value  service  model  as  the  right  approach  to  delivering  comput¬ 
ing  functionality  to  their  customers. 

AllenPort  might  be  the  most  public  example  of  this  new  service-deliv¬ 
ered  computing  model,  but  the  company  is  by  no  means  alone.  At 
Demomobile  2004  on  Sept. 8-10  in  La  Jolla, Calif.,  we’ll  highlight  at  least 
two  companies  making  big  bets  in  this  area.  (To  register  for 
Demomobile  2004,  go  to  www.nwfusion.com,  DocFinder:  3224.) 

Will  service-delivered  computing  be  widespread  in  a  year?  Two  years? 
Three  or  more?  While  the  timeline  might  be  a  mystery, change  is  afoot, 
marked  not  by  devices  but  by  the  services  to  which  those  devices  con¬ 
nect.  Change  is  driven  harder  and  faster  than  ever  before  by  those 
empowered,  demanding,  always-on  people. 

Shipley  is  executive  producer  of  The  Demo  Conferences,  a  Network 
World  -owned  event  that  showcases  emerging  technology  products  and 
services.  She  can  be  reached  at  chris@demo.com. 


Carriers  have  a 
huge  and  virtual¬ 
ly  untapped 
opportunity  to 
become  the  data 
center  for  their 
mobile  wireless 
customers. 


REALITY  CHECK 

Thomas  Nolle 

For  some,  Cisco’s  recent  acquisition  of 
Procket’s  intellectual  property  seems  to 
signal  that  the  network  giant  has  no  strat¬ 
egy  What  it  really  signals  is  that  Cisco  has  too 
many  strategies  and  that  at  least  some  in  the 
company  are  trying  to  fix  the  problem.  The 
question  now  is  whether  they  can  succeed. 
Cisco  is  under  competitive  pressure  on  many  fronts.  Juniper  and  Avici 
Systems  are  selling  into  Cisco  carrier  accounts,  and  many  believe  that 
the  need  to  compete  with  these  two  vendors  is  the  justification  for 
Cisco’s  HFR  efforts, culminating  in  the  release  of  the  new  high-end  CRS- 
1  family  At  the  same  time,  low-cost  competitors  such  as  3Com  are  nib¬ 
bling  at  the  price-sensitive  part  of  the  edge  router  and  LAN  market,  and 
rival  Juniper  has  entered  the  customer  edge  space  with  an  access 
router  and  the  NetScreen  Technologies  security  product  set. 

On  the  customer  side,  Cisco’s  favored  competitive  local  exchange  car¬ 
riers  and  interexchange  carriers  are  pretty  much  gone,  and  its  one  car¬ 
rier  star,  AT&T,  is  clearly  in  a  serious  transition  of  its  own  (and  an  Avici 
customer).  The  RBOCs,  with  whom  Cisco  has  always  had  a  strained 
relationship,  threaten  to  be  the  only  players  left  in  the  carrier  market.  At 
the  enterprise,  companies  that  used  to  depend  on  Cisco  for  planning 
their  networks  are  looking  more  to  integrators  and  consultants  for  their 
network  planning,  which  dilutes  Cisco’s  influence  in  the  accounts. 

It’s  Cisco’s  organization  that’s  making  these  pressures  hard  to  deal 
with.  In  the  bubble  period,  Cisco  created  a  bunch  of  product-specific 
organizational  silos  that  divided  up  development  and  marketing  into 
little  tactical  niches.This  structure  proved  effective  for  Cisco  in  the  tac¬ 
tical  market  that  emerged  after  the  bubble  burst.  It’s  not  so  great  in  the 
current  market,  when  enterprise  customers  and  service  providers  are 
taking  a  more  strategic  view  and  want  a  compelling  vision  to  answer 
their  network  concerns.  Who  speaks  for  Cisco  strategy?  A  whole  choir 
of  infighting  product  promoters.  That’s  why  Cisco  recently  named 
Charlie  Giancarlo  as  CTO,  and  his  first  challenge  will  be  dealing  with 


Another  Cisco  face-lift? 


the  product  transition  that  drove  the  Procket  decision. 

The  Procket  chips  and  the  CRS-1  architecture  into  which  they  have  to 
fit  are  the  basis  for  a  new  Cisco  product  architecture  that  eventually 
will  extend  from  core  to  edge.  If  Cisco  can  create  a  new  architecture  for 
its  product  line,  with  a  modular  hardware  system  and  a  modular  ver¬ 
sion  of  IOS,  it  can  sing  with  one  strategic  voice  when  buyers  ask  for  a 
product.  At  the  hardware  level,  Procket’s  low-cost  chips  with  low  power 
and  heat  dissipation  are  a  key  element.  But  what  about  the  organiza¬ 
tional  level?  Every  step  of  the  way,  the  new  products  will  collide  with  all 
the  products  Cisco  already  has  in  that  space. 

If  Cisco  is  going  to  get  into  strategic  product  development  and  mar¬ 
keting,  it  has  to  break  up  its  product  silos.  We’ll  know  whether  Cisco  is 
remaking  itself  when  we  see  the  company  pull  its  development  groups 
out  of  the  product  silos  and  make  them  independent.  Independent 
development  can  build  to  one  strategic  concept  that  takes  the  archi¬ 
tecture  of  the  CRS-1  and  the  contribution  of  Procket  and  builds  not 
only  a  new  product  family  but  also  a  new  Cisco. Otherwise,  internal  pol¬ 
itics  will  chew  up  the  notion  of  a  new,  harmonized  Cisco  product  set. 

For  decades,  Cisco  has  been  the  champion  of  a  network  with  distrib¬ 
uted  features  and  intelligence  —  IOS  being  the  vehicle  for  doing  the 
distributing. Today  both  enterprise  users  and  carriers  want  dumb  cores 
with  intelligence  moved  more  to  the  edge.The  new  CRS-1 /Procket  com¬ 
bination  could  produce  this  shift,  and  Giancarlo  could  shepherd  it 
along  —  if  every  product  manager  doesn’t  develop  a  private  strategy 

What  happens  if  Cisco  doesn’t  shift  to  the  strategic  vision  of  product 
development?  In  military  terms,  it’s  called  “defeat  in  detail.”  Product  is¬ 
lands  become  less  capable  of  pulling  other  Cisco  products  through  and 
less  effective  as  platforms  for  network-wide  features  that  excite  buyers. 
Margins  shrink,  profits  fall, stock  price  dips  —  you  get  the  picture. 

It’s  show  and  tell  time,  Cisco.  Show  us  you’re  a  strategic  leader  again. 


It’s  show  and  tell 
time,  Cisco.  Show 
us  you’re  a 
strategic  leader 
again. 


Nolle  is  president  of  CIMI,  a  technology  assessment  firm  in  Voorhees, 
N.J.  He  can  be  reached  at  (856)  753-0004  or  tnolle@cimicorp.com. 
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Business  changes  and 
IT  is  the  first  to  know  it. 


Adapt.  Quickly.  HP  ProLiant  BL  blade  systems.  By 
combining  blade  servers,  storage  and  networking 
capabilities  into  a  single  modular  system,  growing 
businesses  and  global  corporations  alike  have 
unprecedented  power  to  scale  quickly,  manage  their 
networks  centrally  and  pool  resources  at  a  moment’s 
notice.  Now  you  can  be  ready  for  change,  even 
before  it  arrives,  www.hp.com/info/proliant 


MESSACELABS  ANNOUNCES  THE  BEGINNING  OF 
THE  END  OF  EMAILS  YOU  DIDN’T  ASK  FOR, 
FOR  THINGS  YOU  DON'T  WANT,  FROM  PEOPLE 

YOU  DON’T  KNOW. 
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, Defend  against  spam.  At  Internet  level.  Where  MessageLabs  operates  a  complete  email  security  and  management  system.  MessageLabs'  patented 
Trifogy  combined  with  multiple  techniques  provides  industry-leading  filtering  accuracy  designed  to  identify  the  email  you  want  and  filter  out  the  email  you 
i^Arrd  artificial  intelligence  learns  from  every  message  it  intercepts,  maximizing  your  protection  from  past,  present  and  future  spam  techniques. 

can  Ihoose  from  multiple  options  for  handling  spam  emails  including  an  off-site  quarantine  service.  Global  businesses  looking  for  a  managed  email 
service  turn  to  MessageLabs  for  a  higher  level  of  protection.  It’s  where  The  Bank  of  New  York,  Computer  Sciences  Corporation,  Air  Products  and  Chemicals 
‘fie. federal  Reserve  Bank  of  New  York  turn  for  spam  control. 

jyu  TkvTi tV'A/  ':■!?  Turning 

To  only  grit. emails  you  ask  for,  for  things  you  want,  from  a  company  you  know.  fv  a  MessageLabs  email  security 

J  J  inside  out 


Call  (866)  460  0000  or  visit  www.messagelabs.com/here 
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■  BY  STEVE  ULFELDER 


IT  EXECS  AT  SPAM-MAGNET 


INDUSTRIES  COME  UP  WITH 


CREATIVE  WAYS  TO  BLOCK 


SPAM  WHILE  KEEPING  LEGITI 


MATE  E-MAIL  FLOWING 


How  do  you  set  your 
spam  filters  to  block 
key  words  when  the 
Viagra  mail  has  to 
get  through? 


\  Believe  it  or  not,  Dan  Lukas,  lead  secu¬ 
rity  architect  at  Aurora  Health  Care, 
makes  no  attempt  to  halt  e-mail  with 
!  "Viagra”  in  the  subject  line. 

Here's  why:  Junk  e-mailers  learned  long 
ago  that  when  properly  capitalized  and 
/  spelled,  Viagra  (along  with  cousins 
j  Levitra  and  Cialis)  is  a  dead-bang,  Katie- 
J  bar-the-door,  raise-the-drawbridge-and- 
s,  flood-the-moat  signal  for  any  self-respecting 

spam  filter.  Hence  the  increasingly  bizarre 
variants  of  such  words  in  spam  subject  lines:  v- 
i-a-g-r-a,  Ci@lis,  L*V*TR*  and  so  on. 

“It’s  gotten  so  that  an  e-mail  that  just  says  'Viagra'  is 
extremely  likely  to  be  legitimate,”  says  Lukas,  whose 
duties  include  spam  fighting  at  Milwaukee  healthcare 
provider  Aurora,  which  has  about  35,000  employees. 

The  hassles  of  spam 
affect  all  industries 
and  are  well  docu¬ 
mented.  According  to 
the  International  Tele- 
e  o  m  m  u  n  i  c  a  t  i  o  n 
Union,  the  annual  cost 
of  spam  has  topped 
$25  billion,  with  a  pre¬ 
posterous  80%  of  all 
e-mail  sent  consisting 
of  junk.  In  corpora¬ 
tions,  spam  takes  a  toll  on  worker  productivity,  band¬ 
width  and  storage,  and  can  harm  a  company  brand  and 
lead  to  lawsuits. 

But  for  some  businesses  —  those  whose  products,  ser¬ 
vices  or  terminology  have  been  hijacked  by  junk  e-mail¬ 
ers  —  the  problem  is  even  more  complex;  IT  needs  to 
make  sure  employees  send  and  receive  legitimate  infor¬ 
mation  without  being  inundated  by  spam. 

Companies  involved  directly  or  tangentially  in  indus¬ 
tries  such  as  healthcare,  pharmaceuticals,  financial  ser¬ 
vices,  credit  reporting,  entertainment  and  employment 
services  all  face  extraordinary  spam-filtering  challenges. 

They  tend  to  use  a  baseline  of  industry-standard  strate¬ 
gies,  tactics  and  technologies,  plus  some  extra  special 
tricks  —  such  as  allowing  "Viagra"  subject  lines  through. 


“It’s  gotten  so  that 
an  e-mail  that  just 
says  ‘Viagra’  is 
extremely  likely  to 
be  legitimate.  ’’ 


Layering  it  on  thick 

“Regardless  of  industry,  you  have  to  take  a  layered 
approach  —  you  need  to  identify  the  information  that’s 
coming  in.  where  it’s  coming  from,  what  its  content  is  and 
where  it  s  going,”  says  Stephen  Singh,  a  vice  president 


Dan  Lukas  of  Aurora  Health  Care  uses  gateway  appliances  to  filter 
incoming  and  outgoing  e-mail  for  spam,  but  he  also  lets  end  users 
do  some  of  their  own  filtering.  V  .  V 


Top  10  bottom  feeders 

According  to  Commtouch  Software,  an 
anti-spam  vendor,  in  the  first  half  of  2004, 
the  10  most  frequently  mentioned 
products  or  services  in  spam  were: 


Drugs 

Mortgage/refinance 


Organ  enlargement 


Shopping 


Software  sales 


29.5% 

9.7% 


Financial 

5.9% 

Work  from  home/jobs 

4.1% 

Dating 

3.2% 

Pornography 

3.1% 

Weight  loss 

2.6% 

Other  notable  entrants  included  beauty  and  health  products  (2.5%). 

debt  “solutions”  (2.5%).  university  degrees  (2.4%)  and  vehicle 

warranties  (1.9%). 

and  chief  network  architect  at  Fidelity  Investments 
in  Boston. 

At  Aurora  Health  Care, “We  hit  spam  from  a  cou¬ 
ple  of  different  angles,”  Lukas  says.  The  company 
uses  four  McAfee  WebShield  e500  gateway  appli¬ 
ances  —  two  each  for  incoming  and  outgoing 
mail.  In  addition  to  virus-scanning,  the  appliances 
use  customizable  Bayesian  filtering  algorithms, 
which  Lukas  says  he's  “dialed  down  to  catch  more 
stuff  than  the  default,”  because  of  the  company’s 
spam-sensitive  industry. 

Aurora  end  users  also  get  the  opportunity  to  do 
some  of  their  own  spam  filtering.The  McAfee  appli¬ 
ances  attach  a  value  to  each  message,  and  any 
email  that  fails  to  meet  a  given  threshold  is  deemed 
spam  and  dropped.  However,  borderline  emails  — 
those  just  below  the  threshold  —  can  be  marked  as 
potential  spam  and  placed  in  a  separate  folder  in 
recipients’  Lotus  Notes  email. There  users  can  de 
cide  whether  to  accept  the  messages. 

According  to  Gartner  analyst  Betsy  Burton,  this 
user-tunable  component  is  increasingly  popular 
and  important,  especially  in  spam-sensitive  com¬ 
panies.  “Were  seeing  more  multi-level  approaches 
to  spam  filtering,”  Burton  says.  “That’s  important 
because  while  a  lot  of  junk  is  what  you  might  think 
of  as  ‘classic  spam’  some  spam  is  in  the  eye  of  the 
beholder” 

Fidelity’s  Singh  says  that  while  the  financial-ser¬ 
vices  firm  does  not  yet  offer  individual  spam  filtering 
at  the  desktop,  such  a  plan  is  “under  consideration.” 

Users  willing  to  accept  extra  junk 

Overall,  Aurora  blocks  50,000  to  60,000  spam  mes¬ 
sages  each  day  for  its  35,000  employees.  Lukas  esti¬ 
mates  the  company  receives  90,000  to  100,000 
spams  daily;  he  concedes  that  a  big  chunk  of  junk 
continues  to  reach  end  users  but  adds  that  in  the 
healthcare  industry, “A  little  bit  of  aggressiveness  can 
bite  you.”  Better  to  grin  and  bear  a  bit  of  extra  junk 
to  ensure  that  all  legitimate  e-mail  comes  through. 


Waxing  and  waning 

Any  discussion  of  spam-sensitive  industries  needs  to  include 

ISPs.  ISPs  spend  a  fortune  trying  to  reduce  the  quantities  of  junk 
mail  sent  to  —  and  by  —  their  subscribers.  ISPs  formed  the  Anti-Spam 
Technical  Alliance  expressly  for  that  purpose.  The  alliance  has  taken  measures  such  as  target¬ 
ing  “zombie”  PCs  that  are  used  to  launch  mass  mailings  without  their  owners'  knowledge. 

Despite  efforts  on  the  legislative  and  technical  fronts,  only  the  most  optimistic  ISPs  hope 
for  decisive  victory  over  spammers  in  the  foreseeable  future.  So  they've  learned  to  savor  the 
temporary  triumphs,  short-lived  though  they  might  be. 

Cable  television  provider  and  ISP  Charter  Communications  recently  earned  one  of  these 
short-term  breathers.  Charter,  of  St.  Louis,  switched  to  an  anti-spam  approach  that  uses 
Symantec’s  Brightmail  for  content  filtering  and  IronPort  Systems  software  for  network 
monitoring. 

"Those  are  our  two  new  weapons,"  says  Laurie  Jill  Wood,  director  of  Internet  security  at 
Charter.  In  the  first  24  hours  of  the  Brightmail/lronPort  use,  the  company  blocked  31  million 
spams  from  customer  mailboxes,  according  to  Bob  Bosco,  director  of  Charter’s  mail  and 
Web  complex.  (The  company  has  1.8  million  subscribers.)  Many  customers  immediately 
noticed  and  commented  on  the  spam  reduction,  she  adds. 

“Charter  understands  that  blocking  spam  is  an  ongoing  effort.  Hopefully,  we  can  keep 
ahead  of  the  game,"  Wood  says. 

—  Steve  Ulfelder 


While  the  major  pharmaceutical  companies 
declined  to  comment  on  how  they  deal  with 
Viagara-type  spam, experts  say  it’s  probably  a  mix  of 
light  and  heavy  filtering,  depending  on  the  user. 
Gartner’s  Burton  points  to  educational  institutions 
as  another  example.  Because  of  the  tradition  of 
wide-open  information  flow  in  academia,  she  says, 
“Professors  and  students  are  going  to  want  to 
receive  all  sorts  of  stuff  that  you  probably  don’t  want 
administrators  to  get.” 

Even  without  user-customiz-  S' 
able  filtering,  businesses  can  /  '  ^ 

accommodate  individual 
users  —  until  the  company 


gets  too  big.  Venture  capital  firm  Ardesta  that 
invests  in  firms  specializing  in  nanotechnology 
and  micro-electromechanical  systems.  Because 
words  such  as  “investment”  and  “opportunity”  are 
so  prominent  in  its  legitimate  e-mail  traffic, the  Ann 
Arbor,  Mich.,  company  could  face  a  spam  night¬ 
mare,  according  to  Jeffrey  Rinvelt,  IT  director. “We 
really  get  hammered,”  he  says.  “You  want  to  be 
accessible,  but  you  don’t  want  [e-mail]  to  become 
unusable.” 

Moreover,  the  70  users  Rinvelt  supports  have 
widely  varying  demands  regarding  spam.  Those 
close  to  the  front  lines  are  loath  to  miss  a  single 
message  and  thus  are  willing  to  put  up  with  a 
heavy  load  of  junk  mail. 

Rinvelt  uses  Sunbelt  Software’s  iHateSpam  con¬ 
tent  filter  because  he  says  the  product  makes  it 
easy  for  him  to  offer  users  their  own  filtering  pro- 
files.“Some  users  want  to  be  aggressive, some  more 
passive,”  he  says.  “I  set  them  up  on  an  individual 
basis.”  Naturally  in  larger  companies  this  becomes 
unworkable. 

No  DIY,  please 

For  nearly  all  corporations,  even  small  to  midsize 
businesses,  the  spam  problem  has  become  too  big 
for  do-it-yourself  solutions.  Pacific  Crest  Securities, 
a  boutique  investment  bank  and  brokerage  firm  in 
Portland,  Ore.,  with  offices  in  Boston  and  San 
Francisco,  learned  that  lesson  the  hard  way. 

Until  last  year, “We  tried  to  let  people  use  [Micro¬ 
soft]  Outlook  tools”  to  deal  with  junk  e-mail  on  an 
individual  basis,  says  Joe  Williams,  systems  ad¬ 
ministrator.  Each  of  Pacific  Crest’s  100  or  so  employ¬ 
ees,  primarily  research  analysts  and  investment 
bankers, “maintained  their  own  spam  list,”  he  says. 

The  idea  had  curb  appeal;  the  company  had 
more  than  its  share  of  tech-sawy  power 
users,  and  in  a  spam-sensitive  industry  it 
seemed  wise  to  let  individuals  decide 
how  to  separate  the  wheat  from  the 
chaff.  However,  sometimes  power 
users  outsmart  themselves.  “People 
tried  to  fine-tune  their  filters”  through 
custom  whitelists  and  blacklists, 
Williams  says.  Trouble  ensued.  “All  of  a 
sudden,  guys  weren’t  getting  mail,”  he  says. 
“Every  time  we  checked  it  out,,  it  was 
[because  of]  a  rule  they’d  added  on  their  own.” 

Nearly  a  year  ago,  Pacific  Crest  realized  it  was 
time  for  IT  to  seize  control  of  the  anti-spam  effort. 
The  company  opted  for  Brightmail’s  product, 
which  immediately  eliminated  the  problem  of 
employees  losing  legitimate  e-mail.  (Symantec 
recently  purchased  Brightmail.)  “For  a  while  we 
quarantined  everything  and  checked  for  false  pos¬ 
itives,”  Williams  says,  adding  that  Brightmail  elimi¬ 
nated  the  problem. 

For  the  most  part,  the  tactics  that  help  any  com¬ 
pany  fight  junk  e-mail  apply  to  all  industries. 
However,  IT  managers  in  sensitive  industries  need 
to  go  that  extra  mile  to  come  up  with  approaches 
that  can  accommodate  the  special  needs  of  their 
end  users. 

Ulfelder  is  a  technology  and  automotive  writer  in 
Southborough ,  Mass.  He  can  be  reached  at 
sulfelder@charter.net. 
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CoreStreet  scales  digital 


Security  certificate 
management 


W'  U  BY  RODNEY  THAYER,  NETWORK  WORLD  LAB  ALLIANCE 

hats  the  point  of  deploying  a  digital  certificate  infrastructure  if  you  can’t 
readily  check  the  status  of  certificates?  That’s  where  CoreStreet’s  Real 
Time  Credentials  comes  in. 


In  our  test  of  this  system  —  which  uses 
the  Online  Certificate  Status  Protocol 
(OCSP)  —  we  found  that  while  its 
unique  approach  works  as  advertised,  it 
might  be  overkill  for  most  companies 
using  a  certificate  infrastructure.  The 
usefulness  of  this  product  will  not  be 
fully  realized  until  more  applications 
support  OCSP 

CoreStreet  provides  certificate  status 
services  through  a  network  of  distributed 
OCSP  responders,  lightweight  servers  that 
do  not  contain  sensitive  cryptographic 
information  and  can  be  safely  distributed 
throughout  a  company 

A  central  RTC  Validation  Authority  (RTC 
VA)  retrieves  the  Certificate  Revocation 
List  and  a  list  of  all  issued  certificates 
from  the  underlying  certificate  authority 
to  generate  proofs,  or  pre-built  OCSP 
responses  (see  graphic,  right).  Then  RTC 
Responders  retrieve  these  proofs  from 
the  RTC  VA  using  HTTP  and  to  generate 
OCSP  responses  for  queries  from  an 
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Real  Time  Credentials 
Authority  and  Responder  I 


OVERALL  RATING 


Company:  CoreStreet,  www.cores 
.com  Cost:  Pilot  installation  of  500  u 
with  1,500  certificates  costs  $20,000.  P 
Provides  distributed  OCSP  service 
scales  to  very  large  certificate  hieranc 
isolates  sensitive  cryptographic  cor 
nents.  Cons:  Difficult  to  operate  if 
scheduled  updates  are  needed;  adc 
complexity  if  existing  Certificate  Auth 
supports  OCSP;  requires  additiona 
client-side  software  in  many  cases. 
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Security  features  30% 
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Management/ease  of  use  30% 
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Documentation  20% 
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Installation  10% 
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Standards  compliance  10% 
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TOTAL  SCORE 

3.4 

Scoring  Key:  5:  Exceptional;  4:  Very  good;  3: 
Average;  2:  Below  average;  1:  Consistently 
subpar 


OCSP  requestor.  Security  applications 
that  process  certificates  issue  OCSP  re¬ 
quests.  The  application  then  uses  the 
OCSP  response  to  determine  the  certifi¬ 
cates  validity 

The  RTC  VA  and  each  RTC  Responder 
are  managed  separately  through  a  Web- 
based  GUI. There  also  is  a  command-line 
interface  to  the  RTC  VA,  but  we  found  it 
incomplete.  Each  component  has  its 
own  error  log  that  resides  on  the  individ¬ 
ual  Validation  Authority  and  Responder 
systems.  There  is  no  capability  to  inte¬ 
grate  these  internal  log  files  with  an 
external  log  management  system. 

To  tap  into  RTC  services,  security 
devices  must  support  Secure  Sockets 
Layer  (SSL),  802. IX,  IPSec  or  some 
other  certificate-aware  protocol,  and  be 
configured  to  check  the  status  of  the 
certificate.  Not  many  applications 
directly  support  OCSP  yet.  Several  ven¬ 
dors,  including  CoreStreet,  offer  add-on 
products  that  enhance  Internet 
Explorer,  Internet  Information  Server 
and  Windows  to  add  status-checking 
based  on  OCSP  Mozilla  natively  sup¬ 
ports  OCSP  and  future  versions  of 
Windows  will  as  well. 

We  installed  RTC  VA  and  RTC 
Responder  software  on  two  Windows 
systems  (see  How  we  did  it  at 
www.nwfusion.com,  DocFinder:  3225). 
The  documentation  provides  only  a  par¬ 
tial  installation  guide.  The  default  con¬ 
figuration  uses  some  non-standard 
ports,  so  you  have  to  reconfigure  it  to 
integrate  with  most  certificate  authori¬ 
ties.  CoreStreets  implementation  of 
OCSP  makes  assumptions  about  how 
your  certificate  authority  works  and 
about  how  the  OCSP  requestor  works.  It 
expects  serial  numbers  to  be  sequen¬ 
tial,  which  the  standard  doesn’t  require. 
It  also  expects  the  OCSP  implementa¬ 
tion  to  not  use  the  “nonce”  feature  —  an 
identifying  value  included  in  OCSP 
requests  and  response  protocol 
designed  to  prevent  replay  attacks.  Not 
using  nonce  violates  the  standard. 

RTC  VA  Web  management  interface  is 
not  configured  to  support  SSL  connec¬ 
tions  by  default,  and  changing  the  set¬ 
tings  to  support  SSL  is  not  documented. 
The  default  configuration  for  the  RTC 
Responder  uses  SSL,  but  it  uses  a  self- 
signed  certificate  and  assumes  you 


The  Real  Time  Credentials  process 


O  Certificate  Authority  issues  a  server  certificate  and  publishes  a  root  certificate  and  Certificate  Revocation 
List.  The  certificate  is  installed  on  the  Web  server. 

©  RTC  VA  uses  certification  information  to  generate  proofs.  Proof  is  then  retrieved  by  RTC  responder. 

©  Client  browser  initiates  SSL  connection  to  the  Web  server  and  receives  the  proper  certificate. 

©  The  OCSP  requester  running  inside  the  browser  checks  the  status  of  the  certificate  against  the  “proof’ 
stored  on  the  RTC  responder. 


have  a  management  workstation  that 
uses  a  browser  configured  with  client 
certificates. 

The  RTC  VA  interface  uses  a  role-based 
administrative  model.  The  installation 
procedure  required  changing  roles  fre¬ 
quently  from  Administrator  (to  perform 
database  updates)  to  Officer  (for  manag¬ 
ing  certificates)  to  Auditor  (for  checking 
certificate  authority  status). 

We  set  up  a  scenario  where  the  status 
of  the  Web  server’s  certificate  could  be 
checked.  The  certificate  issued  by  our 
OpenSSL  certificate  authority  to  the  Web 
server  contained  the  URL  of  the  RTC 
Responder.  The  browser  used  the  URL 
from  the  certificate  to  send  an  OCSP 
request  for  certificate  status  to  the 
Responder. 

Our  choice  of  an  underpowered  plat¬ 
form  for  the  responder  proved  that  the 
vendor’s  claims  that  the  RTC  Responders 
are  not  resource-intensive  are  true.  Both 
the  normal  case  of  a  valid  certificate  and 
the  case  where  we  attempted  to  use  a 
revoked  certificate  worked  as  expected. 

Certificate  status  is  updated  automati¬ 
cally  on  a  periodic  basis.To  force  imme¬ 
diate  change  propagation,  you  have  to 
manually  intervene  on  each  compo¬ 
nent  to  perform  an  update. Updating  the 
RTC  Validation  Authority  for  a  10,000 
certificate  Lightweight  Directory  Access 
Protocol  database  took  8  to  9  minutes 


on  our  test  server. 

The  vendor  says  its  Validation  Auth¬ 
ority/Responder  configuration  solves  the 
problem  of  poor  performance  when  cal¬ 
culating  OCSP  responses.  In  our  example 
with  10,000  certificates,  it  took  11  sec¬ 
onds  for  its  software  to  generate  all  pos¬ 
sible  responses. 

OCSP  has  not  been  widely  supported 
in  the  past,  but  it  now  is  being  built  into 
most  commercial  and  open  source  cer¬ 
tificate  authorities.  (See  more  on  OCSP  at 
DocFinder:  3226.)  While  the  CoreStreet 
RTC  system  provides  a  scalable  alternate 
to  these  built-in  OCSP  capabilities,  it’s 
really  only  a  necessary  addition  to  your 
network  if  you  need  to  manage  a  huge 
number  of  certificates. 


Thayer  is  an  independent  security  con¬ 
sultant.  He  can  be  reached  at  rodney@ 
canola-jones.  corn. 


 Lab  Alliance 


Thayer  also  is  a  member  of  the  Network 
World  Lab  Alliance,  a  cooperative  of  the  pre¬ 
mier  testers  in  the  network  industry,  each 
bringing  to  bear  years  of  practical  experience 
on  every  test.  For  more  Lab  Alliance  informa¬ 
tion,  including  what  it  takes  to  become  a  part¬ 
ner,  go  to  www.nwfusion.com/ailiance. 
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orwich  Success  Story  #68 


www3.norwich.edu/msia 
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IT  contract  management 

Manufacturer’s  homegrown  system  tracks  thousands  of  telecom  and  product  agreements. 


BY  DENISE  PAPPALARDO 


Sorting  through  dozens  of  binders  at  multiple  locations  to  find 
one  of  Flowserve’s  1,785  IT  contracts  was  not  an  optimal  way  to 
access  the  company’s  latest  desktop  software,  hardware,  leasing 
and  telecom  agreements.  But  that’s  the  process  Flowserve  relied 
on  when  the  manufacturer  of  pumps,  valves  and  seals  grew  from 
a  $900  million  company  to  a  $2.4  billion  company  in  just  three 
years.  A  simple  Excel  spreadsheet  acted  as  a  table  of  contents 
for  more  than  30  binders  that  held  copies  of  the  company’s 
contracts  around  the  globe. 


“With  the  expansion  we  often  found  ourselves  scrambling  for  infor¬ 
mation  whenever  IT  contracts  were  due,  needed  renewal, or  needed 
to  be  consolidated  or  put  in  place," says  Pieter  Schoehuijs,  IT  direc¬ 
tor  for  Flowserve’s  Flow  Solutions  Division  in  Irving, Texas. 

About  18  months  ago,  a  Flowserve  programmer  created  an 
IT  contract  management  tool  based  on  Lotus  Notes  in  a  sin¬ 
gle  day.“We  documented  our  basic  requirements, such  as 
fields  and  functionality  in  a  two-page  design,”  Schoe¬ 
huijs  says.  The  fields  included  information  such  as 
contract  value;  the  name  of  the  agreement;  owner; 
contract  length  and  dates;  and  supporting 
documents  such  as  a  PDF  file  of  the 
contract  and  supporting  attach¬ 
ments  such  as  an  Excel  spread¬ 


sheet  or  Word  document. 

In  February  2003,  IT  folks 
input  basic  contract  informa¬ 
tion  from  the  old  Excel 
spreadsheet  to  the  Notes 
application,  along  with 
electronic  copies  of 
many  of  the  con¬ 
tracts.  The  data- 
initially 
n  c  1  u  d  e  d 


about  300  contracts  from  the  Dallas  office,  but  after  making  some  tweaks  to  the  applica¬ 
tion,  the  tool  quickly  was  made  available  to  Flowserve’s  40  IT  managers. 

IT  employees  are  responsible  for  entering  into  the  system  the  contracts  they  oversee. 
“They  really  embraced  using  this  tool  because  it  has  value,” Schoehuijs  says.The  system 
now  holds  1,785  contracts  from  373  vendors,  and  1,107  of  those  contracts  are  active. 

The  system  immediately  paid  off.“In  the  U.S.it  only  took  one  phone  call  to  a  local  phone 
supplier  of  some  of  our  locations  to  get  a  15%  discount  [after]  recognizing  our  total  size 
rather  than  doing  the  best  we  can  per  location,”  he  says.  Flowserve  had  five  separate  con¬ 
tracts  with  the  carrier,  which  Schoehuijs  prefers  not  to  name. 

Having  contract  data  at  their  fingertips  gives  Flowserve’s  IT  managers  leverage  when 
negotiating  new  contracts.  For  example,  if  a  contract  owner  sits  down  with  IBM  to  renew 
a  disaster-recovery  contract,  that  owner  wants  to  be  aware  of  all  the  55  contracts  Flowserve 
has  with  IBM. 

And  because  Flowserve  is  an  international  organization,  being  able  to  access  contract 
information  from  the  company’s  overseas  offices  is  an  important  negotiating  tool. 

Month-to-month  hardware  lease  contracts  also  came  to  light  after  the  system  was  up  and 
running.“If  a  three-year  lease  contract  for  hardware  lapses  and  goes  to  a  month-to-month 
contract, you  pay  a  premium, ’’Schoehuijs  says, noting  that  a  month-to-month  contract  costs 
15%  to  20%  more  than  a  multi-year  deal. 

The  system  sends  an  e-mail  notification  to  a  contract  owner  100  days  before  a  contract’s 
expiration  date,  35  days  before  and  finally  on  the  expiration  day. 

Flowserve’s  IT  group  now  manages  its  portfolio  of  IT  contracts  proactively  by  managing 
its  suppliers  rather  than  having  the  suppliers  manage  the  manufacturer,  Schoehuijs  says. 
“No  more  automatic  renewals  unless  we  choose  to  do  so.” 

Improved  risk  management  is  another  benefit  of  the  system,  which  gives  Schoehuijs  and 
his  team  a  better  handle  on  who  is  managing  which  contracts.  Among  Flowserve’s  IT  staff 
there  are  87  contract  owners  responsible  for  following  up  with  vendors. 

“The  value  of  the  application  is  obvious  for  us.  We  know  we  are  quicker  in  recognizing 
end-of-contract  situations,  and  we’re  doing  a  better  job  of  leveraging  contract  negotia¬ 
tions,”  Schoehuijs  says. 


alueofthe  application 
obvious  for  us.  We  know  we 
quicker  in  recognizing  end-of- 
contract  situations,  and  we're 
doing  a  better  job  of  leveraging 
contract  negotiations. 


Market  contraction 

Contract  management  can  be  a  stand-alone  function  or  it  can  be  integrated  with  ERP  or 
CRM  applications.  In  Flowserve’s  case,  it  is  a  stand-alone  application,  but  Schoehuijs  says 
he  can  see  a  time  when  it  is  integrated  with  other  applications  to  further  extend  benefits. 

While  Flowserve  built  its  own  tool,  off-the-shelf  contract  management  applications  pro¬ 
vide  the  same  function  for  all  types  of  contracts  in  a  company,  not  just  IT. Vendors  include 
a  mix  of  well-known  companies  such  as  Ariba, Oracle  andSARand  lesser-known  firms  such 
as  Deltek,  I-many  and  Neoforma.  On  average,  a  midsize  contract  management  installation 
and  service  package  could  cost  between  $40,000  and  $80,000,  according  to  IDC. 

Last  year  corporate  users  spent  about  $496  million  on  contract  management  appli¬ 
cations,  says  Scott  Tiaztun,  a  program  manager  at  IDC.  The  research  firm  forecasts 
spending  on  contract  management  applications  to  jump  to  $720  mil¬ 
lion  by  2007. 

Although  growing  in  popularity,  the  use  of  contract  management 
applications  is  far  from  commonplace.  In  a  recent  IDC  survey  of  500  IT 
executives,  2 1 . 1  %  already  implemented  contract  management  and  1 1% 
planned  to  do  so  this  year.  But  28.4%  have  no  plans  to  implement  con¬ 
tract  management  software,  and  another  23%  aren’t  sure.  For  some 


■1 


users,  the  benefits  are  just  not  compelling  enough  to  push  it  onto  their 

IT  budget  in  the  near  future. 


Pieter  Schoehuijs 

IT  director,  Flowserve 
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As  Flowserve  has  experienced,  however.  IT  doesn’t  have  to  spend 
much  to  see  benefits.  Flowserve  used  its  existing  Lotus  Notes  platform 
and  Dominos  server.  And  because  the  database  is  not  large  Schoehuijs 
to  deploy  a  new  server. "A  negligible  investment  will  go  a 

and  pay  off  imrnediateiyf  he  says.  <3 
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Custom  Management  Levels 

.  - - : - : - 

OBSERVER 

•  Decode  over  500  protocols 

•  Long-term  network  trending  &  analysis 

J.-  •  Real-time  statistics 

.  '  ’ 

EXPERT  OBSERVER 

•  What-lf  Modeling  Analysis 

•  Expert  Analysis 

•  Connection  Dynamics 

OBSERVER  SUITE 

•  Complete  SNMP  device  management 

•  Supports  full  RM0N1 ,  RM0N2,  HCRMON 

•  Web  Publishing  Reports 
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Remote  &  Hardware  Options 

REMOTE  NETWORKING  PROBES 

•  Fully  distributed 

•  Monitor  up  to  64  NICs  simultaneously 

•  New  levels  of  problem  solving  collaboration 

GIGABIT  &  WAN  HARDWARE  OPTIONS 

•  Portable  analyzer  systems 

•  Rack-mount  Probes  ready  to  go 

•  Direct,  passive  link  for  independent  views 


US  &  Canada  Toll  free:  (800)  526-5958  •  Fax:  (952)  932-9545  •  UK  &  Europe:  +44  (0)  1959  569880 

•  One  Network  Complete  Control  Wired  to  Wireless  •  LAN  to  WAN 
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OBSERVER 


AKE  IT  HAPPEN 

Test-drive  the  new  Observer  9  today  and  see  how  it  immediately 
finds  problems  you  didn’t  know  you  had,  optimizes  network  traffic 
and  provides  insight  for  future  planning.  Call  800-526-5958  for 
a  full  featured  evaluation  or  visit  our  website  at 

www.networkinstruments.com/nine 
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Introducing  Observer  9 

•  New  Application  Analysis 

•  Remote  probes  now  provide  multi-interface  and 
multi-session  support 

•  Industry-first  4G8  packet  capture  buffer 

•  Wireless  Site  Survey  Modes 

•  Nanosecond  resolution 

•  Now  over  450  Expert  Events 

•  SNMP,  RMON  and  now  HCRMON  support 
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How  Do  You 
Distribute 
20,000  Watts  in 


Sentry  CDU  Cabinet  Power  Distribution 

'  High-density  Equipment  Cabient  Power  Distribution  « 

-  ‘  84-Outlet  Receptacles  « 

'  20,000  Watt'  3-Phase  Power  Distribution  Model  « 

10,000  Watt  208  VAC  Power  Distribution  Model  « 

' .  True  RMS  Power  Monitoring  per  Branch  Circuit « 

•  .  *  -,  Local:  Digitial  Displays,  Remote:  via  Interface 

•  :>• 

.  .-  Input  Power  Monitoring  Facilitates  Load  Balancing - 

• 

■  Web  Interface 

,  ;  SNMP,  MIB  &  Traps 

integrated  Temperature  &  Humidity  Probes - 

Cdlor-coded  Outlets  by  Branch  Circuit/Electrical 
,  .  Phase  for  Easy  Identification 

ieriterRatl  Notch"  for  Simplifying  Cabinet  installation  - 

....  ■ 

V'-’V?"'-;  vv,.,  S-.*,  -V 

■  '  i-A.  .  ;.*V  N.:  .  V, 

•  t>:.  Sentry  te  t  trademark  ol  $ar*e*  technology.  inc 


Server 

Technology 

Solutions  for  the  Data  Center  Equipment  Cabinet 


Power  demands  from 
today's  new  servers  require 
greater  power  distribution 
in  the  equipment  cabinet. 
The  Sentry  CDU  distributes 
power  for  up  to  42  dual¬ 
power  1 U  servers  in  one 
enclosure.  Single-phase  or 
3-phase  input  with  110  VAC, 
208  VAC  or  mixed  110/208 
VAC  single-phase  outlet 
receptacles. 


Server  Technology,  Inc. 

1040  Sandhill  Drive 
___  Reno,  NV  89521 -USA 

toll  free  +1 .800.835.1 51 5 
mSal  tel +1.775.284.2000 
1  |  fax +1.775.284.2065 

www.servertech.com 

sales@servertech.com 


SENSAPHONE® 


irvis-anaa 
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SNMP 
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Monitors 

64 

IP  addresses 


Embedded 
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Server 


Sends 
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Power 
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Alarming 


Internal 

UPS 


Microphone 
8  R|-45  Sensor  Inputs  lor  Sound 

(Temperature,  Humidity,  Monitoring 

Water,  Motion,  Power, 

Smoke/Fire) 


Control 

Interface 


Ethernet 

Port 


Voice, 
Modem 
&  Pager  Port 


BE  NOTIFIED  BEFORE  CRITICAL  EVENTS  TURN  INTO  DISASTER! 


•  Eight  environment  inputs 

•  Power  sensing 

•  Monitors  64  IP  addresses 

•  Send  alerts  to  64  people 

•  8  methods  of  contact 

•  Calendar  scheduling 

•  Expands  to  256  sensors 

•  Remote  power  control 

•  Optional  camera 


The  Sensaphone  IMS-4000  Infrastructure 
Monitoring  System  monitors  critical  environ¬ 
mental  and  network  elements  in  your  server 
room,  data  center,  or  telecomm  installation  and 
reports  to  you  instantly  when  events  threaten 
your  infrastructure.  The  IMS-4000  keeps  watch 
so  you  don't  have  to.  See  these  features  and 
more  on  the  web  at  www.ims-4000.com 


Phonetics,  Inc. 

Tel:  877-373-2700 

901  Tryens  Road 

www.ims-4000.com 

Aston,  PA  19014 

Still  searching  for  that  perfect 


no  more 
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and  RADIUS 


Cyclades  elevates  today’s  KVM  solutions  with  the  AlterPatlf  KVM/net 
AlterPatlf  KVM/net.  In  direct  response  to  feedback  EnterPr,se  solutions 
from  serving  80%  of  Fortune  100  companies, 
the  AlterPatlf  KVM/net  brings  a  unique  set  of 
features  unparalleled  in  the  market  today: 

■  KVM  over  IP 

■  Up  to  500  ft  (CAT-5)  cabling 

■  Up  to  1024  servers  per  system 

■  Integrated  power  management  capability 

■  Advanced  Security  &  server-based  Authentication 

With  fifteen  years  of  networking  expertise,  only  Cyclades  can  offer  a  complete 
out-of-band  management  solution  that  connects  your  environment  today  and 
integrates  into  your  data  center  of  tomorrow. 

Call  us  now  and  put  an  end  to  your  search. 


www.cyclades.com/nw 

1.888.cyclades  ■  sales@cyclades.com 

©2004  Cjrdocbs  Corporation.  All  rights  resort  All  other  liorttmsifa  oml  prodod  imoges  on  prapattr  of  fair  rnpodln  moon  Piodstl  Mornotioo  u.i><od  lo  dunge  Mttknj: 
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MARKET! 


NetworkWorld 

~  THE  HUB  OF  THE  NETWORK  BUY 


Intelligent  Serial  Port  ©v'/itch  with 

internal  Modem 


Internal  33.6  Kbps  Modem 
Secure  Dialback  Feature 
Password  Protection 
Invalid  Access  Lockdown 
Periodic  Modem  “AT”  Refresh 
Seven  RS232  DB-9  Console  Ports 
Any-to-Any  Port  Switching 
Non-Connect  Port  Buffering 
Data  Rate  Conversion  300  to  115K  bps 
AC  and-48  DC  Power  Options 


nr-—* — , 
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The  APS-8M  Asynchronous  Port  Switch  is  a  cost 
effective  Terminal  Server  alternative,  plus  you  get  an  internal  modem 
which  saves  rack  and  cabling  hassles.  Connect  multiple  devices  for  on-site 
and/or  dial-up  remote  communications.  High  data  throughput,  full  modem 
and  data  flow  control  all  add  up  to  make  the  APS-8M  the  perfect  data  switch 
or  today’s  remote  network  management  applications. 


□ 
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www.wti.com 


(800)  854-7226 


western  telematic  incorporated 

5  Sterling  •  Irvine  •  California  926  1  8-25  1  7 


Celebrating  our  40th 
Year  in  DataCom 


“Keeping  the  Net.. .Working!” 


SERVERS  WITHIN  YOUR  REACH 
FROM  ANYWHERE 


A  KVM  switch  allows  single  or  multiple 
workstations  to  have  local  or  remote  access  to 
multiple  computers  located  in  server  rooms  or 
on  the  desktop  regardless  of  their  platforms 
and  operating  systems.  KVM  switches  have 
traditionally  provided  cost  savings  in  reducing 
energy  and  equipment  costs  while  freeing  up 
valuable  real  estate. 


Recognized  as  the  pioneer  of  KVM  switch 
technology,  Rose  Electronics  offers  the 
industry's  most  comprehensive  range  of 
server  management  products  such  as  KVM 
switches,  extenders  and  remote  access 
solutions.  Rose  Electronics  products  are 
known  for  their  quality,  scalability,  ease  of  use 
and  innovative  technology. 


Rose  Electronics  is  privately  held  with  world- 
headquarters  in  Houston,  Texas  and  sells  its 
products  worldwide  through  a  large  network  of 
Resellers  and  Distributors.  Rose  has 
operations  in  the  United  Kingdom,  Spain, 
Germany,  Benelux,  Singapore  and  Australia. 
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DRAWS?  WflH  KVM  SWITCH  OPTION 


'Rose  Electronics 

•  •  VQ707  Standiff  Road 

Houston,  Texas  77099 

fe'..  ,  ■ 

ROSE  US  +281  933  7673 

ROSE  EUROPE  +44  (0)  1264  850574 

ROSE  ASIA  +65  6324  2322 

ROSE  AUSTRALIA  +617  3388  1540 


•  Connects  1,000  computers  to  multiple  user  stations 
over  IP  or  locally 

•  High  quality  video  up  to  1280  x  1024 

•  Scaling,  scrolling,  and  auto-size  features 

•  Secure  encrypted  operation  with  login  and  computer 
access  control 

•  Advanced  visual  interface  (AVI) 

•  No  need  to  power  down  servers  to  install 

•  Free  lifetime  upgrade  of  firmware 

•  Available  in  several  models 

•  Easy  to  expand 


800  333  9343 

WWW.ROSE.COM 


KVM  MATRIX  SWITCH 
ACCESS  OVER  IP  OR  LOCALLY 


Connects  up  to  1000  computers  to  a  KVM  station 
Models  for  4,  8,16  computers 
Advanced  visual  interface  (AVI) 

Compatible  with  Windows,  Linux,  Solaris,  and  other  O/S 

Connects  to  PS/2,  Sun,  USB,  or  serial  devices 

Converts  RS232  serial  to  VGA  and  PS/2  keyboard 

Free  lifetime  upgrade  of  firmware 

Security  features  prevent  unauthorized  access 

Full  emulation  of  keyboard  and  mouse  functions  for  automatic, 

simultaneous  booting 


•  Easy  to  expand 


xT-^electronics 


KVM  SWITCH  SUPPORTS  UP 
TO  1000  COMPUTERS 
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GTA  Firewall  Products 

Tough  Network  Security 


Choose  from  5  Firewall  Appliances  to 
Match  Your  Network  Infrastructure 

Easy,  Flexible  Implementation 

Certified  to  ISCA  4.0  Corporate 
Standards 

IPSecVPN 


H2A  -  High  Availability 

Gigabit  Ethernet  Support 

NIC  expansions 

Affordable  pricing 

GTA  Experience  -  Building 
Firewalls  for  Over  1 0  Years 


Surf  Sentinel®  2.0  -  Content  Filtering 


For  more  information 
on  ads /ertmn^  in 
^etworfc  M/or(</f*  MarfcetMace; 
800-bll-1l08 
c/r„*a(es®nww*com 
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Attention  Resellers! 


SECUREMATICS 

The  Right  decision  for  Security  Products 

Best  Source  for  SONICWALL 
Security  Products! 


LIMITED  TIME  OFFER! 

•  Earn  1  FREE  SonlcU  e ‘Training 
Class  for  every  $15K  In  SonicWALL 
purchases  from  Securematlcs." 

•  New  SonicWALL  Resellers  will  receive  1  FREE 
SonlcU  Electronic  Training  Course  with  purchase 


of  any  Demo  Unit 


Call 


Securematics  is  a  SonicWALL  Authorized  Distributor  &  Training  Partner 
To  slon  up  for  the  Medallion  Partner  Program,  please  contact  us. 

888-746-6700  sales@securematics.com  www.securematics.com 


Luggage,  Fine  Leather  Goods, 
Gifts,  and  more! 

Tumi,  Hartmann,  Andiamo, 
Samsonite,  Cross 
10%  discount  for  Network 
World  readers 
Enter  code  NWW2004 


•  Tl/El  &  T3/E3  Modems 

•  RS-232/422/485  Modems  and 
Multiplexers 

•  IBM  3270  Coax,  AS400  Twinox,  and 
RS6000  Modems  and  Multiplexers 

•  LAN  -  Arcnet/Ethernet/Token  Ring 

•  Video/Audio/Hubs/Repeaters 

•  I  SO - 9  0  0 1 

•  USB  Modem  and  Hub 


J.f.  m  m 

Toll  Free  866  SITech  1 
630-761-3640,  Fax  630-761-3644 
www.sitech-bitdriver.com  or  www.silechfiber.com 


.^s-coe  alt 


SJeC^R^t 


WWW.RECURRErslT.COM 


[VISA 

1  nTl 

iJhjT 

careers 


it  careers.com 


i 


SW  Engineer  -  Design  &  develop 
call  control  s/ware.  Analyze  si 
ware  requirements  &  functional 
specs.  Design,  code  &  test  criti¬ 
cal  Call  Control  functionality  in¬ 
cluding:  translations,  CLASS  5/4 
Services,  AIN  basic  Call  Model, 
messaging  &  associated  proto¬ 
cols.  Participate  in  design  &  code 
reviews.  Maintain  existing  s/ware 
systems.  Test  &  integrate  tele¬ 
com  products.  Must  have  Bach  in 
EE,  Comp  Eng'g/Sci,  or  other  rel¬ 
evant  field.  +  2  yrs  exp  in  job  of¬ 
fered  or  2  yrs  telecom  s/ware  de¬ 
velopment  exp.  Must  have  know¬ 
ledge  of  Internet  Protocols,  as 
well  as  telecom  tools  such  as 
INET  &  GDB.  Suitable  candidat¬ 
es  must  also  have  strong  coding 
skills  in  C  programming  lang¬ 
uage.  40hrs/wk.  Salary:  $80,000/ 
yr.  Send  2  copies  of  resume  to: 
Case#200300205,  Division  of 
Career  Services,  Labor  Certifica¬ 
tion  Unit,  19  Staniford  St.,  1  st  FL, 
Boston,  MA  02114. 

Softline  Systems,  Inc  is  seeking 
qualified  individuals  to  work  at 
client  sites  throughout  the 
United  States.  We  have  open¬ 
ings  for  the  following  positions: 

Oracle  Programmer  Analyst  to 

develop  various  applications, 
user  interface  and  database  pro¬ 
grams  using  Oracle,  PL/SQL 
and  SQL. 

Data  Warehouse  Programmer 
Analyst  to  develop  data  ware¬ 
house  and  data  marts  using 
Business  Objects,  Oracle  and 
PL/SQL. 

Ab-Initio  Programmer  Analyst 

to  develop  data  warehouse  and 
data  marts  using  Ab-Initio, 
Oracle,  SQL  and  PL/SQL. 

Teradata  Developer  to  develop 
Teradata  databases. 

Apply  to:  Softline  Systems,  Inc, 
1600  Boston  Providence  High¬ 
way,  Walpole,  MA  02081. 

PROG.  ANALYST  - 
SYSTEMS  ADMIN. 

Install  new  software  releases, 
system  upgrades  &  software 
patches.  Perform  system  back¬ 
up  &  recovery.  Maintain  data 
files  &  monitor  system  config.  to 
ensure  data  integrity.  BS  degree 
in  Comp.  Sci.,  Electrical  or  Elec¬ 
tronics  Engnrg  +  2  yrs  exp.  in  job 
offered  or  as  a  Software  Engnr  - 
Sys.  Admin,  reqd.  Exp.  must 
include  embedded  programming 
SIP  &  H.323  protocols:  Citrix  on 
AIX  and  Solaris  9.0;  Macola 
ERP  &  Reuters  Kondor  soft¬ 
ware;  &  Production  DBA  in 
Oracle  9,  Sybase  12.5  and  SQL 
Servers.  High  mobility  preferred. 
40  hrs/wk,  OT  as  reqd,  9  am  -  5 
pm,  $66,730/yr.  Submit  resume 
to:  Manager,  Butler  County 
CareerLink.  Pullman  Commerce 
Center,  112  Hollywood  Drive, 
Suite  101,  Butler,  PA  16001- 
5699.  Please  refer  to  Job  Order 
No.  441381. 

Seeking  qualified  applicants  for 
the  following  positions  in  Mem¬ 
phis/Collierville.  TN:  Senior  Bu- 
siness  Annlication  Analvst.  Act 

as  liaison  between  technical 
developers  and  users/custom¬ 
ers.  Requirements:  Bachelor's 
degree  or  equivalent"  in  comput¬ 
er  science,  math,  statistics,  busi¬ 
ness  or  related  field  plus  5  years 
of  experience  in  analyzing  busi¬ 
ness  systems  and  developing 
technical  automated  solutions. 
Experience  with  SQL,  CGI  envi¬ 
ronment  and  J2EE  environment 
also  required.  "Master's  degree 
in  appropriate  field  will  offset  2 
years  of  general  experience. 
Submit  resumes  to  Marc 
Blackburn,  FedEx  Corporate 
Services,  4200  Regent  Blvd., 
Irving,  TX  75063.  EOE  M/F/D/V. 

Software  Engineers  Needed 

Seeking  qual.  candidates  pos¬ 
sessing  MS  or  equiv.  and/or  rel. 
work  exp.  Part  of  the  req.  rel. 
work  exp.  must  include  3  yrs 
working  w/Oracle  Technolo¬ 
gies.  Duties  include:  Support  & 
interface  w/Oracle  applications 
e-business  suite  components 
HR,  PAY,  OAB,  OTL,  OIC,  AP, 
AR,  GL.  INV,  PO  &  OM.  Work 
w/Oracle,  PL/SQL,  Developer, 
Discoverer,  &  Workflow  Builder. 
Send  resume,  references  & 
salary  requirements  to:  Exxor 
Inc.,  8374  Market  St.,  #161, 
Bradenton,  FL  34202. 

SW  Engineer  -  As  member  of 
the  s/ware  development  team, 
design  &  develop  network  man¬ 
agement  s/ware.  Participate  in 
design  &  code  reviews.  Maintain 
existing  s/ware  systems.  Test  & 
integrate  cutting-edge  telecom 
products.  Must  have  BS  in 
Computer  Engineering,  Comp 
Sci,  EE  or  equiv, +  2  yrs  exp  in 
job  offered  or  2  yrs  exp  in  tele¬ 
com  s/ware  development,  "C" 
coding.  Must  have  exp  w/Lynx  & 
LINUX,  GDB,  SmartBits  &  ATM 
Modules.  40  hrs/wk.  Salary: 
$93,000.  Send  2  copies  of 
resume  to:  Case#200300204, 
Division  of  Career  Services, 
Labor  Certification  Unit,  19 
Staniford  St.,  1st  FL,  Boston,  MA 
02114. 

Computer  Touch,  LLC,  is 
looking  for  a  Programmer 
Analyst  to  develop  and  test 
Java  features,  administer 
Unix  Accounts,  create  client 
websites  for  e-commerce 
and  integrate  and  test  GUI 
interface,  and  develop  node 
to  node  routing  protocols  for 
wireless  networks.  Please 
send  all  resumes  to 
Computer  Touch,  LLC, 
9  Belgravia  Terrace, 

Farmington,  CT  06032, 
Atten:  Human  Resources 
Dept. 

Software  Developer  III.  B.S.  in 
Comp.  Sci.  or  rel.  field  +  3  yrs 
complex  programming  exp. 
w/ASP.  VB,  &  MS  Access. 
Exp.  w/HTML,  JavaScript,  & 
structured  analysis  &  dsgn 
methodologies.  Ability  to  write 
complex  SQL  querries. 
Demonstrated  knowl  of  rela¬ 
tional  d/bases  &  object  orient¬ 
ed  methodologies.  Resumes 
to  Erica  Petersen,  4800 
Westown  Pkwy,  #300,  West 
Des  Moines,  IA  50266. 

Convergence  Network 

Specialist,  Hauppauge,  NY. 

Install  and  maintain  Voice 

over  IP  phone  systems.  2 
yrs  in  job  exp.  req’d. 
Resume  only  to  bg@ctnet- 
works.net  or  CT  Networks, 

125  Wireless  Blvd., 

Hauppauge  Technology 
Center,  Hauppauge,  NY 
11788,  Attn:  Barry 

Goldstein. 

PROGRAMMER  ANALYSTS 
for  Overland  Park,  KS  office. 
Develop  &  maintain  software 
applications  using  Orbix, 
J2EE,  MKS,  TEMIP,  Inter¬ 
woven,  Coolgen,  Metrica,  Net- 
rac,  Tuxedo,  Tango,  Eclipse, 
CORBA.  RMI,  RUP.  Bachelors 
Degree  reqrd  in  Computers, 
Engineering  or  related  field  + 
2yrs  of  related  exp.  40  hrs/wk; 
Must  have  legal  authority  to 
work  permanently  in  the  U.S. 
Send  resume  to  HR  Manager, 
Spectrum  Informatics  Inc, 
11936  W  119th  St.,  #141, 
Overland  Park,  KS  66213. 

SW  Engineer  -  Design,  code  & 
test  features  for  cutting  edge 
telecomm  products.  Modify  pro¬ 
duct  features  to  ensure  confor¬ 
mance  to  ANSI  specs.  Analyze 
&  fix  bugs  in  system  as  they 
arise  at  various  customer  sites. 
Must  have  Bach,  in  Computer 
Science/Engineering,  Electrical/ 
Electronics  Engineering,  +  2  yrs 
exp  in  job  offered  or  2  yrs  tele¬ 
com  s/ware  development  exp. 
Must  have  exp  in  telecomm  &/or 
data  networking  industry,  in- 
clud'g  exp  w/SS7  technology.  In- 
depth  knowledge  of  one  or  more 
telecom  protocols  required.  40 
hrs/wk.  Salary:  $80,000/yr.  Send 
2  copies  of  resume  to:  Case# 
200300200,  Division  of  Career 
Services,  tabor  Certification 
Unit,  19  Staniford  St.,  1st  FL, 
Boston,  MA  02114. 


SOFTWARE  ENGINEERS  (12 
positions):  require  Bachelor's  or 
equivalent  in  Engineering/Com¬ 
puter  Science/Mathematics/Sci¬ 
ence  or  closely  related  field  with 
two  years  experience  providing 
skills  in  described  duties,  at 
$79,000  per  year.  Provide  on¬ 
site  consulting  in  design,  analy¬ 
sis  and  development  of  software 
for  legacy  systems  in  IBM  main¬ 
frame  environment;  develop¬ 
ment  and  administration  in  Or¬ 
acle,  DB2,  SQL  Server  and  Sy¬ 
base;  e-commerce  and  web  sys¬ 
tems  development  in  Microsoft, 
Java  and  related  technologies; 
network  management  systems 
development  with  Netscape  Ser¬ 
ver  and  related  tools;  SAP  R/3 
application  systems  on  Windows 
with  DOS  and  ABAP/4  and  relat¬ 
ed  modules.  40%  travel  to  client 
sites  in  the  United  States.  Mail 
resumes  to:  YASH  Technolo¬ 
gies,  Inc.,  605  17th  Avenue, 
Suite  1,  East  Moline,  IL  61244. 


Computers  -  Database  Ad¬ 
ministrators  needed.  Seek¬ 
ing  qual.  candidates  pos¬ 
sessing  BS  or  equiv.  and/or 
relevant  work  exp.  Duties 
include:  Administer  &  sup¬ 
port  database  development 
&  production  environment; 
Work  with  Informix,  Sun 
Solaris,  AIX,  HP-UX,  DB2 
UDB  &  Veritas.  Mail  resume 
&  ref.  to:  Object  Solutions, 
Inc.,  Attn:  HR,  3025  Harbor 
Lane,  Plymouth,  MN 
55447-5119. 


Looking  For 
A 

New  Career? 


The  new 

itcareers.com  and 
CareersJoumal.com 
combined  jobs 
database  can  help 
you  find  one. 
Check  us  out  at: 
www.itcareers.com 
or  call  (800)  762-2977 
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Welcome  to  IT  Careers 
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SAURY 
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!  find  a  job  (  employers  i  features  &  tips 

find  a  job 

;  The  IT  Careers  Network  uses  Ihe  power  of  The  Wall 
;  Street  Journal  s  CareerJoumal  jobs  database  to  bring 
;  you  tha  largest  concentration  of  IT  jobs  available  Get 
;  9-mail  notifications  when  new  jobs  match  your 
j  search  criteria  Post  an  online  resume  and  more 
j  -  search  jobs 
j  •  create  a  Job  Alert 
j  •  adit  a  Job  Alert 

•  post  a  resume 
|  •  edit  your  resume 


post  a  job 

Finding  the  right  IT  professionals  to  fill  your  available 
positions  can  be  a  challenging  and  time  consuming 
effort  IT  Careers  can  help  With  lha  2  2  million 
unique  visitors  9ach  month,  the  online  semces  that 
are  available  through  IT  Careers  is  a  smart  way  to 
deliver  and  job  posting 

•  post  jobs 

•  search  rasumes 

•  become  a  Fealurad  Employer 

•  online  opportunities 


features  &  tips 

!  Gather  the  best  IT  career-related  information, 

!  features,  news  and  lips  from  some  of  Ihe  besl 
|  sources  in  the  industry  They  bring  readers  regular 
!  items  such  as  opinions  and  advice  from  industry 
!  experts,  special  packages  and  supplements  on 
[  career  trends,  salaries,  contracting,  hiring  and 
[  retention  issues 
|  •  Computerworld 


advertiser  tools 


Looking  for  a 
nevw  IT  career? 

Explore  our 
huge  Jobs 
database 

;  Bmjirr  here 


b 


icareers 


www.itcareers.com 


is  the  place  where  your 
fellow  readers  are  getting 
a  jump  on  even  more  of 
the  world's  best  jobs. 

Now  combined  with 
CareerJournal.com, 
you  have  more  jobs 
to  choose  from. 

Stop  in  for  a  visit  and 
see  for  yourself  at: 

www.itcareers.com 
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Senior  Developer  (NYC)  Define 
scope  of  overall  rational  data¬ 
base  modeling  projects. 
Develop  &  implement  project 
strategy  &  architecture,  produc¬ 
tion  schedules,  projections  & 
budget  for  assigned  tasks  and 
roles.  Oversee  installation,  con¬ 
figuring  &  tuning  of  SQL  Server 
6  5.  7.0  &  2000  databases, 
servers  &  Oracle.  Analyze  & 
evaluate  existing  &  proposed 
systems  Develop  computer  pro¬ 
grams/systems  &  related  proce¬ 
dures  to  process  data  Provide 
comprehensive  analysis  for 
clients,  prepare  program  specifi¬ 
cations,  diagrams,  develop  cod¬ 
ing  logic  flowcharts.  &  test  to 
ensure  proper  system  perfor¬ 
mance  Prepare  detailed 
progress  reports  for  manage¬ 
ment  &  schedule  projects  for 
deliverable  reviews  &  Quality 
Assurance  tasks.  BS/MS  in 
Comp  Sci,  or  any  Engg  or  relat¬ 
ed  field  and  relevant  experience 
required.  Send  resume  to  Devon 
Archer,  President,  Sitaro  Group, 
48  Wall  St..  #1100,  NY,  NY 
10005 


TECH.  PERSONNEL 
RECRUITING  MGR 

Work  closely  with  client  &  pro¬ 
ject  mgrs,  assess  technical 
resourcing  rqmnts  of  info,  tech¬ 
nology  projects  for  animation, 
retail,  semiconductor  &  finance 
industries.  Seek  out,  interview  & 
screen  computer  professionals 
with  appropriate  skill  sets.  Train 
software  consultants  on  func¬ 
tional  aspects  of  Enterprise 
Resource  Planning  &  Customer 
Relationship  Management  pack¬ 
ages.  BS  in  Comp.  Sci.  or 
Engnrg  +  2  yrs  exp.  in  job 
offered  or  as  a  Tech.  Recruiter 
reqd.  Must  have  exp.  in  func¬ 
tional  aspects  of  SAP  HR 
Blueprinting,  Siebel,  PeopleSoft, 
Maya,  Kondor  and  IEF  technolo¬ 
gies  skill  sets.  High  mobility  pre¬ 
ferred.  40  hrs/wk,  OT  as  reqd,  8 
am  -  5  pm,  $54, 597/year. 
Submit  resume  to:  Manager, 
Butler  County  CareerLink, 
Pullman  Commerce  Center,  112 
Hollywood  Drive,  Suite  101, 
Butler,  PA  16001-5699.  Please 
refer  to  Job  Order  No.  WEB 
440046. 


SW  Engineer  -  As  member  of 
s/ware  development  team,  de¬ 
sign  &  develop  call  control  si 
ware.  Analyze  s/ware  require¬ 
ments  &  functional  specs.  De¬ 
sign,  code  &  test  critical  Call 
Control  functionality  includ'g: 
translations,  CLASS  5/4  Servic¬ 
es,  AIN  basic  Call  Model,  mes¬ 
saging  &  associated  protocols. 
Participate  in  design  &  code  re¬ 
views.  Maintain  existing  s/ware 
systems.  Test  &  integrate  tele¬ 
com  products.  Must  have  BS  in 
Computer  Engineering,  Comp 
Sci,  EE  or  equiv,  +  2  yrs  exp  in 
job  offered  or  2  yrs  telecom 
s/ware  development  exp.  Must 
have  knowledge  of  internet  pro¬ 
tocols  &  the  following  telecom 
tools:  CVS,  GNU,  LYNX,  UNIX, 
INET  &  HAMMER,  as  well  as 
strong  coding  skills  in  C.  40hrs/ 
wk.  Salary:  $75,000/yr.  Send  2 
copies  of  resume  to:  Case# 
200300199,  Division  of  Career 
Services,  Labor  Certification 
Unit,  19  Staniford  St.,  1st  FL, 
Boston,  MA  02114. 


SW  Engineer  (Technical  Servic¬ 
es)  -  Ensure  integrity  of  design, 
development,  implementation,  & 
testing  of  communication  s/ware 
for  company's  cutting  edge  tele¬ 
com  products.  Resolve  complex 
problems  caused  by  anomalies 
in  one  or  more  of  telecom  s/ware 
or  network  sub-systems.  Repro¬ 
duce  problems  in  lab  to  isolate 
s/ware  problems  to  affected 
module(s).  Develop  interim  solu¬ 
tions  to  problems  encountered 
in  the  field.  Assess  ways  to 
enhance  product  reliability  & 
serviceability.  Recommend  ap¬ 
plicable  process  improvements 
to  enhance  service  delivery/ 
offerings.  Work  closely  w/Sus- 
taining  Engineering  to  obtain 
root  cause  analysis  of  reported 
anomalies.  Must  have  BS  in 
Computer  Engineering,  Comp 
Sci,  EE  or  equiv,+  2  yrs  exp  in 
job  offered  or  2  yrs  exp  recreat¬ 
ing,  diagnosing  &  solving  com¬ 
plex  problems  in  telecom  or  data 
networks.  In-depth  knowledge  of 
one  or  more  telecom  protocols 
(i.e,  SS7,  TCP/IP,  etc.);  scripting 
languages  (i.e.  TCL/Expect,  UN¬ 
IX  shell  programming,  or  PERL, 
as  well  as  C  or  C++)  &  telecom 
testing  tools  &  equipment.  40hrs 
/wk.  Salary:  $82,000.  Send  2 
copies  of  resume  to:  Case# 
200300203,  Division  of  Career 
Services,  Labor  Certification 
Unit,  19  Staniford  St.,  1st  FL, 
Boston,  MA  02114. 


Software  Analyst/  Business 
Development  Manager:  Duties 
include  gathering  requirements, 
doing  business  analysis  and 
proposing  solutions  for  IT  needs 
of  healthcare  and  pharmaceuti¬ 
cal  industry.  Will  build  and  lead 
team  to  develop  and  customize 
software  dealing  with  clinical  tri¬ 
als  for  the  pharmaceutical  indus¬ 
try.  Requirements  Bachelor  of 
Science  degree  in  Science  or 
Technology  Field  or  equivalent 
and  1  year  coursework  in  medi¬ 
cine  or  pharmacology  required. 
Must  have  3  yrs.  exp.  software 
analyst/business  development 
manager  or  3  yrs.  exp.  in  mar¬ 
keting  and/or  research  in  the  IT 
field.  Since  TechNation  has 
clients  located  in  several  states 
and  since  assignments  are  of 
temporary  nature,  candidates 
must  be  willing  to  move  from 
location  to  location  for  assign¬ 
ment  duration  that  varies  from  3 
mos.  to  year.  Email  CV  to 
rtroff@tnscinc.com,  Rona  Troff, 
HR  Mgr  of  TechNation  Software 
Consulting,  Inc.,  or  mail  to  300 
N.  Dakota  Avenue,  #505B, 
Sioux  Falls,  SD  57104. 


Database  Administrator 
needed.  Responsible  for 
providing  technical  leader¬ 
ship  for  organization's 
Oracle  database  environ¬ 
ment.  Must  have  B.Sc.  in 
computer  engineering  and 
1  yr.  experience.  Mail 
resume  to  Gerrie  Teddy  @ 
ITS,  2500  City  West  Blvd., 
Ste.  2400,  Houston,  TX 
77042  or  email  to; 
gteddy@itsinc.com 


IT  Network  Engineer  -  Assist  in 
analyzing  local  &  wide  area  net 
systems  Plan/design  LAN, 
MAN,  &  WAN  networks  utilizing 
Shared/Switched  Ethernet,  Gib- 
abit  Ethernet,  FDDI,  &  Token 
Ring,  in  addition  to:  TCP/IP.  IPX/ 
SPX,  SNMP,  DHCP,  AppleTalk, 
X.25,  ATM,  &  Frame  Relay,  RIP, 
OSPF,  IGRP,  EIGRP,  BGP,  ISL, 
802. 1q,  VTP,  &  STP.  Assist  in 
resolving  interoperability  prob¬ 
lems  to  obtain  operations  across 
all  platforms  including  e-mail,  file 
transfer,  multimedia,  &  telecon¬ 
ferencing.  Provide  support  to 
tech  network  systems  using 
above  protocols,  Network  Analy¬ 
zer,  channel  coding  &  transmis¬ 
sion  theory,  number  systems, 
codes,  digital  electronic  signals 
&  switches,  Boolean  algebra  8 
reduction  techs,  arithmetic  oper¬ 
ation  &  circuits,  code  converters, 
multiplexers,  &  demultiplexers. 
Select  op  systems,  protocol  sts 
&  configuring  comm  media  us¬ 
ing  bridges,  routers,  gateways, 
transport  media,  TCP/IP.  IPX/ 
SPX,  &  SNA.  Provide  network 
modeling  &  simulation  assis¬ 
tance  to  deliver  client/server  app 
functionality.  BS  Comp  Sci,  Eng 
or  related  &  working/theoretical 
knowledge  of  LAN,  MAN,  WAN 
networks,  Shared/Switched  Eth¬ 
ernet,  Gigabit  Ethernet,  FDDI, 
Token  Ring  topologies,  TCP/IP, 
IPX/SPX,  SNMP,  DHCP.  Apple- 
Talk,  X.25,  ATM,  SFrame  Relay, 
RIP,  OSPF,  IGRP,  EIGRP,  BGP, 
ISL,  802. 1q,  VTP,  STP  proto¬ 
cols,  Network  Analyzer,  channel 
coding,  knowledge  of  digital 
electronic  signals/switches, 
Boolean  algebra  &  reduction 
techniques,  arithmetic  operation 
&  circuits,  code  converters,  mul¬ 
tiplexers,  demultiplexers,  Bridg¬ 
es,  routers,  gateways,  transport, 
media  &  SNA.  $65,300/yr.  M-F. 
40  hrs/wk.  Denver,  CO.  Must 
have  proof  of  legal  authority  to 
work  permanently  in  U.S.  Appli¬ 
cation  by  resume  only  to  Work¬ 
force  Development  Programs, 
PO  Box  46547,  Denver,  CO 
80202.  Ref  Job#CO5086185. 


An  environmental  engineering 
consulting  firm  with  emphasis  on 
mine  remediation  &  restoration 
is  seeking  a  GIS  Database  Ad¬ 
ministrator.  Resp.  inc.  devlp'g  in¬ 
tegrated  d-bases  for  tracking  re¬ 
medial  actions  at  historic  sites 
such  as  the  Bunker  Hill  Super¬ 
fund  Site,  work  with  in-house  & 
EPA  Scientists,  Civil  Engineers 
&  proj.  mgrs.  to  des.  d-bases  & 
secure  online  interfaces  to  re¬ 
trieve  site  info,  such  as  owner¬ 
ship,  soil-water-dust  samples, 
analytical  results  &  other  reme¬ 
dial  properties.  Collect  user 
reqs,  design,  implement,  man¬ 
age  &  maintain  integrity  of  Envi¬ 
ronmental  &  Geog.  Info.  Sys. 
(GIS)  d-bases  for  mine  remedia¬ 
tion  &  restoration  projects.  Use 
computer  technology  &  tools 
such  as  MS-SQL  server.  T-SQL, 
ASP  communications,  Java  & 
VB  scripts,  SAS  statistical  tech., 
ArcGIS,  EquIS  &  Win.  Server 
2000.  Reqs.  are  Bach,  in  Mining 
Enginr'g  or  Comp.  Sc.  &  2  yrs. 
rel.  exp.  incl.  mining  reclamation 
&  remediation  d-base  devlpmt. 
U.S.  evaluated  equiv.  Bach,  of 
Technology  in  Mining  Engineer'g 
with  noted  exp.  is  acceptable. 
M.S.  &  1  yr.  exp.  is  acceptable  in 
lieu  of  Bach,  &  2  yrs.  exp.  Send 
resume  to  HR  Mgr.,  Terra 
Graphics  Environmental  Engin¬ 
eering,  Inc.,  121  S.  Jackson  St., 
Moscow,  Idaho  83843. 


"SUCCESS 

JOIN  THE  $300  BILLION 

COMPUTER  SERVICE  BUSINESS. 


Find  out  how  you  can  invest  in  one  of 
Entrepreneur  Magazine's  “HOT  100 
Franchises”,  and  in  a  Franchise  Times 
“FAST  55”  company.  Single,  Multi-Units 
and  Area  Development 
Opportunities  are  now  available. 
For  more  information  call 

or  visit  us  at  ^7) 

geeksoncall.com 


ks  On  Call  America,  Inc 


Computer  Programmer;  40 
hrs./wk.  7:30am-4:30pm  M-F. 
$54,000/yr.  Develop  and  en¬ 
hance  computer  programs  and 
decision  support  systems  for 
employee  benefit  plans  using 
third  generation  structured  pro¬ 
gramming  languages  &  Win¬ 
dows  based  technologies;  web¬ 
site  development  both  dynamic 
database  driven  &  static  page 
websites  including  designing, 
testing,  and  implementing  of 
same;  add  new  options  to  exist¬ 
ing  programs;  document  large 
projects  defining  new  programs, 
enhancements,  database  struc¬ 
ture.  database  administration 
and  system  flow  using  MS  Word 
and  Vision;  confer  with  clients 
and  coworkers  to  define  new 
programs  and  modifications; 
communicate  with  clients  re¬ 
garding  changes  made  to  pro¬ 
grams  and  facilitate  training 
required  to  use  new  or  modified 
programs;  stay  current  on  new 
technology  items  by  reading, 
attending  seminars  &  continuing 
education.  Ed.  Req.  Bach,  or 
Ed.  Eq.  in  Computer  Science, 
MIS,  Commerce.  Business  Ad¬ 
ministration  &  2  yrs.  exp.  as 
Software  Systems  Analyst,  Sys¬ 
tems  Engineer,  Software  Con¬ 
sultant  or  comb.  Work  exp.  must 
include  2  yrs.  With  Visual  Basic 
6,  Structured  Query  Language, 
Transact  SQL  for  Microsoft  SQL 
Server  7,  ASP  coding,  n-tier 
application  development,  Data 
Modeling,  Visual  Studio,  Data¬ 
base  Design  &  Administration, 
HTML,  DHTML  Javascripts,  VB¬ 
Script,  Crystal  Reports,  Access, 
ADP.  COM,  Visual  C++,  Front¬ 
page,  Flash,  Adobe  Photoshop, 
packaging  and  deployment  com¬ 
ponents  of  Visual  Studio.  Send 
resumes  to  Michigan  Depart¬ 
ment  of  Career  Development, 
P.O.  Box11170,  Detroit,  Ml 
48202-1170.  Incl.  ref.  #222603  & 
social  security  #  w /  Resume. 
Employer  Paid  Ad. 


Senior  Consultant 

(Glen  Mills,  PA  and  other  loca¬ 
tions  throughout  the  United 
States).  Manage  a  team  of  client 
and  consulting  resources  for  the 
life  cycle  of  SAP  implementation 
projects,  with  a  particular  focus 
on  companies  in  the  manufac¬ 
turing  industry.  Perform  all  re¬ 
quired  SAP  (IM/WM/SAP  Con¬ 
sole)  configuration  and  testing. 
Prepare  functional  specifica¬ 
tions,  unit  and  integration  testing 
scenarios.  Design,  configure, 
implement,  and  test  transactions 
for  Inventory,  Warehouse  Man¬ 
agement  and  Shipping.  Create 
queries,  identify  and  analyze 
master  data  and  inventory  load 
errors  and  rectify  problems. 
Provide  on-site  implementation 
and  Go-Live  support  for  the 
clients.  Utilize  SAP  interfaces 
including  ALE,  IDocs,  and 
Remote  Functions  Calls  (RFC), 
and  Barcoding  Technology. 
Assist  in  developing  business 
cases. 

The  wage  offered  is  $105,368/ 
year.  The  work  schedule  is 
Monday-Friday  9:00am-5:00pm. 
The  minimum  requirements  are 
as  follows:  Bachelor's  degree  in 
Computer  Science,  Math,  Bus¬ 
iness  Administration,  Informa¬ 
tion  Systems,  or  Engineering 
(any)  +  5  years  experience  in 
the  job  offered  or  5  years  experi¬ 
ence  as  a  Consultant,  Systems 
Analyst  or  Project  Team  Mem¬ 
ber.  Related  experience  must 
include  SAP  Console  configura¬ 
tion,  SAP  RFC  (Remote  Func¬ 
tion  Cells),  Barcoding  Technolo¬ 
gy,  SAP  ALE  configuration,  SAP 
IDoc  Configuration,  SAP  Inven¬ 
tory  Management,  and  Ware¬ 
house  Management  configura¬ 
tion. 

Please  send  your  resume,  refer¬ 
encing  Job  Order  Number 
WEB439858  to  the:  PA  Career- 
Link,  FLC  Unit, 235  W  Chelten 
Ave.,  Philadelphia.  PA  19144. 
EOE. 


RedPrairie  Corporation,  world 
leader  in  provision  of  logistics 
execution  systems,  seeks  the 
following:  Managers  (Technical) 
for  supply  chain  execution  appli¬ 
cation  services  at  Cary,  NC, 
office,  to  assist  in  leading  in 
technical  aspects  of  customer 
implementation  &  to  mentor/pro¬ 
vide  administrative  lead  for 
group  of  Software  Engineers. 
Require  Bachelor's  in  Computer 
Science,  MIS,  Engineering  or 
related  field  (equivalent  combi¬ 
nation  education/experience  or 
equivalent  experience  consid¬ 
ered)  plus  3  yrs  experience  in 
computer-related  occupation,  in¬ 
cluding  leadership  role  in  project 
implementing  warehouse  man¬ 
agement  or  supply  chain  soft¬ 
ware,  &  experience  in  automat¬ 
ed  warehouse/distribution  sys¬ 
tems  industry.  Senior  Manager 
for  supply  chain  execution  appli¬ 
cation  services  at  Cary.  NC,  of¬ 
fice,  with  responsibility  for  major 
portion  of  customer  TMS  prod¬ 
ucts,  to  interface  with  internal 
groups  to  enable  delivery  of 
products  that  meet  customer’s 
need.  &  to  serve  as  primary 
point  of  contact  for  customers. 
Require  Bachelor's  Computer 
Science,  MIS,  Engineering  or 
related  field  (equivalent  combi¬ 
nation  education/experience  or 
equivalent  experience  consid¬ 
ered)  plus  5  yrs  experience  in 
computer-related  occupation,  in¬ 
cluding  experience  in  logistics  & 
supply  chain  consulting  or  relat¬ 
ed  field,  TMS  functionality,  & 
management  of  logistics  pro¬ 
jects  Interested  candidates 
should  e-mail,  fax  or  mail  a 
resume  and  cover  letter,  includ¬ 
ing  code  CW1  with  salary 
requirements  to: 

RedPrairie  Corporation 
Attn:  Organizational 
Development 

20700  Swenson  Drive 

Waukesha.  Wl  53186 
Fax:  262-317-2638 
Email:  Recruiter@redprairie.com 


SRCT  Inc.  is  seeking  a 
Software  Engineer 
experienced  on 

AS400,  DB2,  COBOL, 
RPG.  Please  respond 
to  Mr.  Faiz,  3213 
Ridgecane  Rd,  Lex¬ 
ington,  KY  40513. 


Simplex  Info  Systems 

Senior  System  Analysts: 
Analyze,  design,  develop,  test, 
implement,  maintain  and  sup¬ 
port  application  software  using 
COBOL,  PL/1,  MQ  Series,  IMS 
DB/DC,  J2EE,  SAS.  Requires 
Bachelors  in  Computer  Sci¬ 
ence/Engineering  or  Related 
and  2  years  experience. 

Send  resume  to:  HR  Manager, 
Simplex  Info  Systems,  Inc.  76 
Northeastern  Blvd.,  Suite  32C 
Nashua,  NH  03062,  or  email 
to:  resumes@simplexinfo.com. 


McData  Corp.  seeks  applicants 
for  the  position  of  Sr.  Software 
Engineer  in  Sunnyvale,  CA  to 
design  and  develop  Fibre 
Channel  switch  protocols  and 
fabric  services.  Requirements 
include  bachelor's  in  computer 
science  and  3  yrs  exp  as  a  soft¬ 
ware  engineer  in  a  Windows 
2000  and  NT  environment, 
including  one  year  using  Fibre 
Channel  switch  protocols. 
Requirements  also  include 
working  knowledge  of  Fibre 
Channel  analyzers  and  third 
party  HBAs  and  their  manage¬ 
ment  utitities.  Respond  by 
resume  to  Kari  Hill,  McData,  380 
Interlocken  Crescent. 

Broomfield.  CO  80021. 


SOFTWARE  ENGINEER  to  pro¬ 
vide  on-site  consultancy  to 
design  and  develop  embedded 
systems  software  in  real-time 
systems  using  VxWorks  operat¬ 
ing  system,  socket  program¬ 
ming,  TCP/IP  network  protocols 
on  UNIX  platform.  Require: 
Bachelor's  in  Computer 
Science/Engineering  and  four 
years  experience  in  the  job 
offered  or  any  experience  pro¬ 
viding  skills  in  the  described  job 
duties.  40%  travel  to  client  sites 
within  the  United  States 
required.  Salary:  $68,000  per 
year,  40-hours/week,  8:30  am  to 
5:30  pm.  Apply  with  resume  to: 
Human  Resource  Manager,  4C 
Solutions,  Inc.,  1201  7th  Street, 
East  Moline,  IL  61244. 


Software  Engineer  (New 
York,  NY)  wanted  for  design 
and  development  of  multi¬ 
tier  enterprise  and  web 
based  systems.  Must  have 
Bachelor's  degree  in 
Computer  Science  or 
Electrical  Engineering  and 
5  years  experience.  Must 
be  authorized  to  work  in  the 
U.S.  Send  resume  to  Meg 
Lyons,  TradingScreen,  Inc., 
5  Union  Square  West,  4th 
Floor,  New  York,  NY  10003. 


Computer  Programmer: 
Develop/maintain  customer 
databases  using  MIS;  re¬ 
trieve  &  analyze  data  using 
Unix  &/or  DOS-based  PMS 
v9.6f/g;  develop,  modify  & 
maintain  accounting  &  bud¬ 
geting  systems;  system  & 
network  administration  of 
MS  Windows  based  com¬ 
puters.  Req  4  yrs  work  exp 
in  job  offered.  Send  resume 
to  BKN  and  S  Partnership, 
2920  Clairmont  Rd., 
Atlanta,  GA  30329. 
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IT  PROFESSIONALS 
Senior  Consultant 

(Glen  Mills.  PA  and  other  locations  throughout  the  United  States). 
Responsible  for  designing  applications  in  the  Telecommunications  indus¬ 
try  including  implementation  and  testing  of  Siebel  and  WebMethods. 
Gather  requirements,  design  and  build  modules  in  Siebel  and  build  func¬ 
tionality  for  the  data  integration  from  Siebel  to  back-end  applications  uti¬ 
lizing  Workflow  Processes,  Workflow  Policies  and  Business  Services. 
Responsible  for  gathering  requirements  and  design  for  data  integration  in 
Web  Methods  between  various  front-end  applications  and  back-end  appli¬ 
cations  utilizing  High  Level  event  flow.  Low  Level  event  flow  and  Data 
structure  mapping  between  applications.  Responsible  for  custom  coding 
in  Visual  Basic,  e-Script,  and  Java  and  design  and  build  project  status 
applications  in  Microsoft  Access  using  Visual  Basic.  Design  and  build 
Siebel  modules  using  e-Script  for  Accounts  and  Contacts  functionality 
while  integrating  data  from  Siebel  to  back-end  applications.  Design  and 
build  Java  applications  to  test  data  integration  between  front  end  and 
back  end  applications  and  Java  applications  to  log  data  flow  in 
WebMethods.  Responsible  for  designing  and  configuring  billing  modules 
in  Arbor/BP  to  present  billing  information  from  Arbor/BP  to  front  end  appli¬ 
cations. 

The  wage  offered  is  $75, 780/year.  The  work  schedule  is  Monday-Friday 
9  00am-5:00pm.  The  minimum  requirements  are  as  follows:  Bachelor's 
degree  or  equivalent  in  Engineering  (any),  Information  Systems, 
Computer  Science  or  Mathematics  plus  3  years  experience  in  the  job 
offered  or  3  years  experience  as  a  Senior  Consultant,  Consultant,  or 
Systems  Analyst.  Employer  will  regard  a  foreign  degree  to  be  equivalent 
to  a  U.S.  Bachelor's  degree  as  determined  by  an  accredited  credentials 
evaluation  service.  Related  experience  must  also  include  at  least  1  year 
of  implementation  or  testing  of  Siebel  &  WebMethods,  custom  coding  in 
Visual  Basic,  e-Script,  and  Java,  and  designing  and  configuring  billing 
modules  in  Arbor/BP 

Please  send  your  resume,  referencing  Job  Order  Number  WEB439173  to 
the:  PA  CareerLink,  FLC  Unit,  235  W.  Chelten  Avenue,  Philadelphia,  PA 
19144.  EOE 


Business  Analyst  sought  by  Fair- 
field,  CT  Outsource  Service  Prov¬ 
ider  Company.  Duties:  Analysis  of 
new  business  requirements  and 
product  enhancement.  Synthesis 
of  new  business  requirements  in¬ 
to  detailed  technical  product  dev¬ 
elopment  specifications.  Monitor¬ 
ing  and  management  of  the  entire 
cycle  of  ongoing  development 
projects,  including  scheduling, 
code  delivery,  functional  and  ov¬ 
erall  testing,  and  deployment  into 
our  production  environment.  Ana¬ 
lysis  and  resolution  of  technologi¬ 
cal  and  business-logic  related  is¬ 
sues.  Management  of  our  Quality 
Assurance  team.  Must  have  ex¬ 
perience  in  and  knowledge  of  da¬ 
tabases  SQL.  N-tiered  applica¬ 
tions  principles,  ASP  and  VB  pro¬ 
gramming  Object-oriented  analy¬ 
sis  and  design.  Unified  Modeling 
Language.  Automated  testing 
tools  and  bug  tracking  software. 
Must  interact  and  communicate 
with  the  back  office  employees  of 
our  sister  company  who  are  bas¬ 
ed  in  Uzbekistan.  Must  also  have 
experience  in  dealing  with  finan¬ 
cial  markets,  banking  principles 
and  accounting.  Job  to  be  perfor¬ 
med  in  Fairfield,  CT  and  various 
unanticipated  clients  sites  in  the 
U.S  as  assigned.  The  selected 
candidate  must  be  able  to  conv¬ 
erse,  read  and  write  in  the  Rus¬ 
sian  language.  Req.  A  Bachelors 
Degree  or  Equivalent,  in  either 
Applied  Math/Comp.  Sci.,  Busin¬ 
ess  or  Economics,  and  two  years 
of  experience  in  the  job  offered  or 
related  occupation.,  Hours:  9:00 
AM  to  5:00PM,  Mon-Fri,  40  hrs/ 
wk.  Apply  to,  ATTN  BA  Position, 
Foundation  Source  Philanthropic 
Services,  Inc.,  55  Walls  Drive,  3rd 
Fir.,  Fairfield,  CT  06824. 


V.L.S.  Systems  is  a  software 
development  and  consulting  co 
with  multiple  openings  for  Soft¬ 
ware  Engineers,  DBA's,  Pro¬ 
grammer  Analysts,  QA  Testers, 
Financial  Analysts  and  Project 
Managers  to  work  at  client  sites 
in  VA,  IL,  PA  and  other  sites 
throughout  the  U.S.  Individuals 
must  have  a  minimum  of  a 
Bachelor  Degree  and  two  years 
relevant  experience.  We  are 
seeking  individuals  with  various 
combinations  of  the  following 
skills  i:  Siebel,  Oracle  Apps, 
Peoplesoft,  SAP,  MS  SQL, 
SCADA,  DB2,  Sybase,  Abinitio, 
Tuxedo,  OLAP,  ETL  develop¬ 
ment,  Business  Miner,  VSAM, 
Mercator,  Endevor,  SeeBeyond, 
Ot,  C++.  VC++,  ASP.NET,  .net 
technologies.  Business  objects, 
Java,  J2EE,  JNDI,  Java  Script, 
EJBs,  Coldfusion,  Perl,  HTML, 
Cobol,  CICS,  MVS/ESA,  Unisys, 
COM+,  MTS,  Cognos,  Web¬ 
sphere,  Weblogic,  WSAD, 
MVC  Architecture,  Unix,  Win¬ 
dows  NT,  embedded  related 
tools.  Apply  to:  V.L.S  Systems, 
9900  Main  St,  Suite.  304, 
Fairfax,  VA  22031. 


Sr.  Oracle  DBA  sought  by  office 
products  distribution  company  in 
Broomfield,  CO  to  work  in 
Broomfield  and  other  unantici¬ 
pated  job  sites  in  the  U.S.  to  at  a 
senior  level,  design,  install, 
maintain,  and  administer  large 
(10+  CPUs)  OLTP  ORACLE 
relational  database  manage¬ 
ment  systems  in  a  UNIX  clus¬ 
tered  environment.  Design  the 
architecture  and  physical  infra¬ 
structure  for  the  ORACLE  rela¬ 
tional  database  management 
systems.  Design  and  establish 
physical  data  parameters. 
Engage  in  performance  tuning. 
Create  and  implement  security 
and  back-up  and  recovery  pro¬ 
cedures.  Provide  user  support 
and  training.  Engage  in  project 
management  and  design  related 
software  applications  as 
required.  Requires  master’s  or 
equivalent.  Master's  or  foreign 
equivalent  in  comp,  sci.,  elec, 
eng  or  related  field  or  bachelor's 
or  foreign  equivalent  in  comp, 
sci.,  elec,  eng  or  related  field 
plus  5  yrs  of  software  database 
administration  experience:  1  yrs 
Oracle  database  administration 
experience;  2  yrs  exp.  may  be 
concurrent  with  the  5  yrs  exp. 
required  for  the  equivalence  to  a 
master's  described  above;  work¬ 
ing  knowledge  of  designing 
database  architecture  and  phys¬ 
ical  infrastructure,  and  perfor¬ 
mance  tuning  of  large  OLTP 
(10+  CPUs)  ORACLE  relational 
database  management  systems 
in  a  UNIX  clustered  environ¬ 
ment.  M-F;  8am-5pm;$92,500/yr. 
Respond  by  resume  to 
Employment  Programs,  PO  Box 
46547,  Denver,  CO  80202  and 
respond  to  JON  CO  5085898. 


Radian  Information  Systems  is 
seeking  system  analysts,  soft¬ 
ware  engineers  8.  IT  consultants 
to  work  on  ERP,  data  ware¬ 
house,  mainframe  using  SAP, 
PeopleSoft,  VB,  ASP,  Java 
Script,  VSS,  VBScript,  Web 
Methods,  Cognos,  Unix,  Oracle 
etc.  BS/MS  with  exp.  Contact 
lnfo@RadiantlnfoSvs.com  EOE. 

IT  specialists  wanted  by 
ARWANO,  Inc.  for  positions 
using  Oracle,  SQL,  VB,  C/C++, 
SAP.  AS/400,  RPGLE,  COBOL/ 
400,  CL,  SQL/400,  Query/400, 
Oracle  RDBMS,  Developer 
2000,  Windows  NT.  Minimum  is 
BS  degree  with  IT  experience. 
Travel  maybe  required.  Apply  at 
waseem@arwano.com.  EOE. 


SW  Engineer  -  As  member  of  si 
ware  development  team,  design 
&  develop  call  control  s/ware. 
Analyze  s/ware  requirements  & 
functional  specs.  Design,  code  & 
test  critical  Call  Control  function¬ 
ality  includ'g:  translations, 
CLASS  5/4  Services,  AIN  basic 
Call  Model,  messaging  &  associ¬ 
ated  protocols.  Participate  in 
design  &  code  reviews.  Maintain 
existing  s/ware  systems.  Test  & 
integrate  telecom  products.  Must 
have  B.S.  in  Computer  Engineer¬ 
ing,  Comp  Sci,  EE  or  equiv,  +  2 
yrs  exp  in  job  offered  or  2  yrs 
telecom  s/ware  development 
exp.  Must  have  knowledge  in  at 
least  one  of  the  following  tele¬ 
com  protocols:  Call  Processing 
or  TCP/IP,  as  well  as  strong  cod¬ 
ing  skills  in  C.  40hrs/wk.  Salary: 
$78,000/yr.  Send  2  copies  of  res¬ 
ume  to:  Case#200300201 ,  Divi¬ 
sion  of  Career  Services,  Labor 
Certification  Unit,  19  Staniford 
St.,  1st  FL,  Boston,  MA  02114. 


COMPUTERS:  HCL  Techn¬ 
ologies  (MASS),  Inc.  has  multi¬ 
ple  openings  at  its  corporate 
offices  located  in  Quincy,  MA 
and  their  branch  office  in 
Tallahassee,  FL  for  the  following 
positions:  Software  Engineers; 
Systems  Analysts;  Programmer 
Analysts;  Project  Managers; 
Account  Managers/Sales  Mana¬ 
gers;  Sales  Engineers;  Market 
Research  Analysts;  Business/ 
Management  Analysts;  and 
Network  Engineers.  Salary  com¬ 
mensurate  with  education  and 
experience.  All  positions  may 
involve  travel  or  relocation  to 
various  sites  throughout  the 
U.S.  Send  resume  to:  HCL 
Technologies  (MASS),  Inc.  Attn.: 
Rajiv  Shesh,  400  Crown  Colony 
Drive  Suite  #  500  Quincy,  MA 
02169  indicating  the  position 
you  are  applying  for. 


Infomerica  is  looking  for  system 
/programmer  analysts,  software 
/project  engineers  &  computer 
consultants  working  at  different 
sites  (travel  required)  using  Cl 
C++,  Oracle,  Java,  ASP,  Unix, 
EJP,  ERP,  VB,  SQL,  etc.  Must 
have  BS/MS  with  1-year  exp.  in 
IT  fields.  Send  resumes  to 
info@infomericainc.com.  EOE. 


Perk  Systems,  Inc.  is  looking  for 
IT  Analyst/Engineers  to  fill  vari¬ 
ous  positions  using  C/C++,  Ja¬ 
va,  VB,  Web  Tech,  Oracle,  Unix- 
Sun  Solaris,  EJB,  Rational 
Rose/UML,  JSP,  OOAD.  Candi¬ 
dates  must  have  MS/BS  &  IT 
experience.  Apply  at  iobs@ 
perksvs.com.  Travel  maybe  re¬ 
quired.  EOE. 


Optimal  Solutions  Integ¬ 
ration,  Inc.  has  multiple 
openings  for  SAP  and  i2 
Consultants,  Software  Anal¬ 
ysts  and  System  Analysts  in 
our  Irving,  Texas  and 
Washington,  DC  offices. 
Please  send  resumes  with 
salary  history  and  require¬ 
ments  to  Optimal  Solutions 
Integration,  8445  Freeport 
Parkway  #240,  Irving,  TX 
75063.  Open  to  GreenCard 
holders  or  US  Citizens. 


Programmer/Analyst  -  Software 
Art  Corp.,  a  software-consulting 
firm,  requires  software  profes¬ 
sionals  with  demonstrated 
hands-on  experience  in  the  fol¬ 
lowing:  Client  Server:  MS  VB 
NET,  ASP  NET  C#/C++/Oracle 
/Sybase/Windows/Unix  DBA: 
Sybase/SQL  Server  Internet 
Computing:  JAVA/CORBA/XML, 
JAVA  WebsphereA/Veblogic. 

QA  Testers:  Manual/Automated 
Business  Analyst,  National  Ac¬ 
count  Managers  SAS  Program¬ 
mers.  Send  resume  to: 

Software  Art  Corporation 
iowa@softwareart.com 


Managing  Director:  Directs/ 
Coordinates  R  &  D  in  Grid 
Computing.  Plans/formulates  R 
&  D  proposals.  Responsible  for 
strategic  technology  innova¬ 
tion/development/strategic  plan¬ 
ning  process  to  balance  mis¬ 
sion/markets.  Oversees  launch¬ 
ing  of  new  technologically  inten¬ 
sive  products.  Uses  knowledge 
of  federal  government  contract¬ 
ing  regulations,  incl.  proposal 
development/pricing/project 
mgt.  Uses  knowledge  in  com¬ 
puter/communications  networks/ 
grid  computing.  Utilizes  strong 
problem-solving  ability.  Collab¬ 
orates  w/colleagues/scientist/ 
administrators.  Conducts  media¬ 
tion  to  resolve  disputes/manage 
competing  organizational  iss¬ 
ues.  Uses  business/marketing 
skills.  Represents  MCNC  to  aca¬ 
demic/government/commer¬ 
cial/professional  constituencies. 
Req.  Ph.D.  Mathematics, 
Physics,  Computer  Science  or 
related  field,  and  3  yrs  exp.  in 
job  offered  or  3  yrs  exp.  in 
Management  of  R  &  D  in  Grid 
Computing.  Hrs.  8  am  to  5  pm 
Send  Resume  to  MCNC,  Attn; 
Virginia  Graves,  PO  Box  12889 
Research  Triangle  Park,  NC 
27709-2889. 


Technical  Consultant:  Interface 
with  usersflnternal  and  external) 
tOo  define  system  requirements 
and  determine  modification  nec¬ 
essary  for  effective  product. 
Write  code,  complete  program¬ 
ming  and  test  debug  applica¬ 
tions.  Complete  documentation 
and  procedure  for  installation 
and  maintenance  of  product. 
Analyze,  design,  program, 
Troubleshoot,  debug  and  modify 
local,  network  or  internet-related 
computer  programs  for  commer¬ 
cial  or  end  user  applications 
such  as  Process  engineering, 
financial,  Insurance  manage¬ 
ment  or  desktop  applications 
product.  Must  have  Multi 
Platform  environment  experi¬ 
ence,  Manual  and  automated 
testing  experience  and  relation¬ 
al  database  experience  and 
scripting  experience.  B.S  in 
Comp  Science  or  equivalent  and 
2  years  experience  in  job 
offered.  40hrs/wk  (9:00  a.m.  to 
5:00  pm)  $80,878.00/yr.  Please 
send  two  (2)  copies  of 
resume/letters  to  Job  Order 
#2004-174.  P.O.  Box  989, 
Concord.  NH  03302-0989. 


SW  (Test)  Engineer  -  As  mem¬ 
ber  of  s/ware  testing  team,  test 
&  develop  test  automation  s / 
ware.  Participate  in  design  & 
code  reviews.  Write  test  plans 
according  to  system  reqs.  Main¬ 
tain  existing  test  plans  &  auto¬ 
mated  test  scripts.  Test  telecom 
products.  Support  potential  cus¬ 
tomers  during  lab  trials.  Must 
have  BS  in  Computer  Engineer¬ 
ing,  Comp  Sci,  EE  or  equiv,  +  2 
yrs  exp  in  job  offered  or  2  yrs 
exp  w/s/ware  testing  for  the  tele¬ 
com  industry,  including  detailed 
knowledge  of  telecom  protocols, 
general  telecom  procedures,  & 
scripting.  40hrs/wk.  Salary: 
$75,000.  Send  2  copies  of  res¬ 
ume  to:  Case#200300202,  Divi¬ 
sion  of  Career  Services,  Labor 
Certification  Unit,  19  Staniford 
St.,  1st  FL,  Boston,  MA  02114. 


Infobahn  Technologies  de¬ 
livers  innovative  IT  Solu¬ 
tions  to  business  clients 
nationwide.  We  have  im¬ 
mediate  full  time  opportu¬ 
nities  for  Software  Engin¬ 
eers.  All  applicants  must 
have  a  minimum  BS  in 
Computer  Science  Engin¬ 
eering  or  Related  field  plus 
2  years  of  experience. 
Send  resumes  to: 
Infobahn  Technologies, 
(HR)  288  Walnut  St.  #410 
Newton,  MA  02460. 


IT  Careers 
Wants  You! 

Take  the  hassle  out  of 

job  searching  and 

check  us  out  at 

www.itcareers.com. 

Today,  more  than  ever, 
the  right  skills  fuel  the 

new  economy  and  IT 
Careers  wants  you  to  be 

there.  Check  us  out  at: 

www.itcareers.com 
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Network  World  Events  and  Executive 
Forums  produces  educational  events  and 
executive  forums  worldwide,  including  our 
one  day  Technology  Tours,  customized  on 
site  training,  and  executive  forums  such  as  DEMO®,  DEMOmobile®.  and 
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Publicize  your  press  coverage  in 
Network  World  by  ordering  reprints  of 
your  editorial  mentions.  Reprints 
make  great  marketing  materials  and 
are  available  in  quantities  of  500  and 
up.  To  order,  contact  Reprint 
Management  Services  at  (717)  399- 
1900  x129  or  E-mail:  mshober@reprintbuyer.com 
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prime  competitors,  it’s  low.  On  the  busi¬ 
ness  side  there  is  a  fairly  significant  hur¬ 
dle  for  AT&T  to  attach  wireless  into  its 
product  line  when  AT&T  has  not  histori¬ 
cally  had  access  to  that  service.  Sprint 
has  enabled  its  customers  with  wireless 
access  to  other  services,  and  we  have 
enough  lead  time  to  take  full  advantage 
of  that. We  are  not  concerned  that  the 
deal  will  disrupt  our  own  plans  for  our 
business  customers. 

Were  you  thinking  that  if  it  wasn't  Sprint, 
AT&T  would  have  just  signed  the  deal  with 
another  carrier? 

There  is  always  that  case  when  you 
think  about  wholesale  business.That  is 
not  a  primary  reason  to  go  down  this 
path. That  would  have  been  part  of  a 
second,  third  or  fourth  set  of  issues. You 
can  make  the  case  that  if  not  us  then 
someone  else,  but  that  would  be  cop¬ 
ping  out  on  the  strategic  and  financial 
discussion,  which  would  be  first  and  sec¬ 
ond  in  a  competitive  decision. 

Bernard  Ebbers  is  going  to  trial  in 
November.  Should  he  do  jail  time? 

WorldCom  committed  fraud. That  fraud 
rifled  its  way  through  this  industry  big- 
time.  1  was  here  in  the  mid-  to  late  ’90s 
when  we  couldn’t  figure  out  where  their 
margin  percentages  were  coming  from. 
I’ll  let  the  lawyers  determine  what  the 
proper  payment  for  that  is.  It  caused  a 
lot  of  disruption  that  sent  the  industry 
into  a  significant  spiral,  and  there  ought 
to  be  accountability  for  that. 

Did  it  anger  you  personally? 

Absolutely.  One  thing  I  don’t  lose  sleep 
about  is  our  financial  integrity  and 
accounting  integrity  in  this  company 
We’re  now  all  paying  for  companies  that 
have  disrupted  that  trust.  It’s  the  Enrons, 
the  WorldComs,  the  Global  Crossings,  the 
Adelphias  that  created  significant  institu¬ 
tional  distrust. 

Sprint  and  AT&T  recently  said  they  would  not 
actively  go  after  new  consumer  voice  cus¬ 
tomers.  Is  that  waving  the  white  flag? 

There  is  a  very  significant  contrast 
between  Sprint  and  AT&T.  We  didn’t  get 
in  that  [local]  business  until  July  2003. 
We  have  roughly  300,000  customers  on 
our  UNE-P  offering.  [Editor’s  note:  AT&T 
has  4.7  million, and  MCI  has  3.5  million.] 
We  always  thought  of  using  UNE-P  as  a 
transition  to  another  product  or  service, 
which  is  wireless  in  our  case.  We  never 
went  after  this  space  to  attract  new  cus¬ 
tomers  to  Sprint.  It  was  always  an  add-on 
to  long-distance  or  wireless. 

UNE-P  aside,  what  should  the  government  be 
doing  to  fix  telecom? 

1  think  to  wait  for  the  government,  the 


FCC  or  for  legislation,  is  a  foolish  pas¬ 
time.  It  has  been  pretty  clear  over  the 
past  10  years  that  the  regulators  were 
not  going  to  be  able  to  make  all  [com¬ 
petitive  local  exchange  carriers] ,  RBOCs 
and  [interexchange  carriers]  happy 
What  the  government  has  to  pay  atten¬ 
tion  to  is  overall  competition.  Is  cable 
going  to  be  able  to  gain  traction  and 
become  a  viable  competitor  to  the 
RBOCs?  I  think  that’s  probably  the  case. 
Wireless  is  a  real  competitive  threat  to 
the  local-access  business. The  Vonage 
types,  the  power-line  types,  those  are 
niches  around  the  edge  and  will  gain 
some  share,  but  real  competition  will 
come  from  cable  and  wireless. The  gov¬ 
ernment  is  satisfied  that  if  AT&T  or  MCI 
retreated  that  competition  wouldn’t  end. 
There  are  plenty  of  other  sources. 


tance  companies  or  RBOCs  buying  inte¬ 
grated  services  companies  will  be  ap¬ 
proved. The  third  point  is  recognizing  that 
there  isn’t  a  great  record  in  any  market  of 
putting  the  same  stuff  together  and  creat¬ 
ing  shareholder  benefit  in  the  long  term. 
It’s  so  hard  to  do. 

Industry-wide,  do  you  see  a  lot  of  mergers 
and  acquisitions  happening? 

In  the  last  four  years  there  has  been 
one,  AT&T  Wireless  and  Cingular,and 
that’s  not  done  yet.You  have  a  couple  of 
companies  losing  revenue  of  about  15% 
to  20%  per  year.  How  do  you  go  in  and 
figure  out  where  does  that  stop?  I  have 
been  very  clear  about  having  no  interest 
right  now  in  adding  to  our  long-distance 
portfolio.  It  wouldn’t  do  anything  for  our 
mix  of  assets  except  take  our  revenue 
and  growth  percentages  down,  and  it 
would  be  very  distracting. 
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On  the  business  side  it’s  a  little  trickier. 
Everyone  still  relies  on  that  local  last  mile 
for  access.  There  have  been  a  lot  of  met¬ 
ropolitan-area  networks  built  and  there 
have  been  other  alternative  access  tech¬ 
nologies  made  available,  but  there  is  still 
a  huge  reliance  on  the  local  loop. There 
the  government  has  to  be  careful  that  the 
loop  prices  do  not  go  up  extraordinarily 

How  do  you  see  any  industry  consolidation 
playing  out? 

There  is  no  question  that  we’re  an  indus¬ 
try  in  transition. There  are  a  couple  of 
players  in  significant  dire  straits,  and  their 
business  models  do  not  work.There  are  a 
number  of  factors  that  come  into  play 
One  would  be  around  where  does  growth 
ultimately  come  from?  Sprint  is  posi¬ 
tioned  today  as  an  integrated  service  pro¬ 
vider.  We’re  going  to  have  the  highest 
growth  of  any  integrated  provider  with 
our  second-quarter  results.  Investors  are 
looking  for  top-line  and  bottom-line 
growth.  Second,  what’s  the  regulatory  pol¬ 
icy?  There  are  no  clear  signals  coming 
out  of  AT&T  Wireless  and 
Cingular.  It’s  not  clear  that 
RBOCs  buying  long-dis¬ 


Why  should  large  businesses  choose  Sprint? 

Our  network  capabilities  and  our  ac¬ 
count  team  support  have  always  been 
second  to  none  in  terms  of  taking  our 
wire-line  products  and  services  to  large 
businesses.  Our  frustration  has  been:  Even 
though  we  have  98%  of  the  Fortune  1000, 
we  have  a  relatively  small  market  share. 
Our  opportunity  to  take  advantage  of  that 
98%  penetration  and  bring  wireless  into 
that  discussion  is  huge  for  us. That  as 
much  as  anything  is  why  companies 
should  consider  Sprint. We  are  at  the 
nexus  of  companies  that  have  had  a  good 
experience  with  Sprint  on  the  wire-line 
side,  and  as  we  continue  to  make  invest¬ 
ments  in  wireless  data  we’ll  be  able  to 
take  that  experience  to  the  next  level. 
Whether  customers  are  working  off  of  our 
lxRTT,EV-DO  or  IP  VPN  network.  We  have 
a  window  of  time  to  make  that  work, 
which  is  why  we  realigned  ourselves  last 
year  in  a  customer-centered  fashion  as 
opposed  to  down  product  lines. 

What's  your  VoIP  strategy,  and  how  do  you 
plan  to  boost  the  company's  standing  in  that 
area? 

On  the  consumer  side  we  have  clearly 
decided  not  to  play  in  the  Vonage  space; 
our  play  is  wireless.  As  we  continue  to 
invest  in  our  network  capacity  and  cover¬ 
age,  there  will  be  a  point  where  the  cus¬ 
tomer  will  decide  to  cut  their  cord.  We’ll 
also  be  able  to  come  in  with  a  VoIP  offer¬ 
ing  that  will  be  part  of  wireless.  Business 
is  completely  different.  We  are  deploying 
the  technology  and  the  capability  with  IP 
enablement  in  our  network. 

Is  it  true  that  wireless  services  do  not  count 
or  only  count  minimally  toward  an  enter¬ 
prise  customer’s  minimum  annual  revenue 
commitments? 

That’s  evolving,  certainly  for  Sprint 
because  one  of  our  key  strategies  is  to 
make  the  integration  of  wire-line  and 
wireless  work  for  customers. ...  I  would 

probably  fall  short  of  saying 
that  for  every  business  cus¬ 
tomer  we  are  making  all 
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services  equally  contributory  and  eligible 
for  all  deals,  but  for  some  that  is  the  case. 
It  all  hasn’t  been  stitched  together.  But 
certainly  for  large  customers  that’s  our 
strategy. 

Where  is  Sprint  spending  its  research  and 
development  dollars? 

In  the  past  four  or  five  years  investors 
have  become  skeptical  of  big  bets.  In  the 
past  the  company  has  made  some  big 
bets, some  of  which  have  paid  off,  like 
wireless,  and  some  that  have  not,  like  our 
global  ventures  and  [Integrated  On- 
Demand  Network], In  this  environment 
there  has  to  be  a  grand  vision  and  a  pay¬ 
off  that’s  pretty  clear. 

You’re  seeing  us  continue  to  be 
aggressive  [with  the  likes  of]  IP  capa¬ 
bility  that  our  local  division  is  rolling 
out  replacing  circuit  switched  technol¬ 
ogy  with  packet  switch  gear.  We’re  mak¬ 
ing  significant  investments  on  devices. 
Whether  its  classic  R&D  or  innovation 
working  with  handset  manufacturers 
like  Sanyo  and  Samsung  to  be  sure 
we’re  anticipating  what  the  network 
can  provide  to  customers. 

Do  you  have  a  concern  about  price  wars? 

That’s  in  the  top  three  or  four  questions 
I  get.This  has  been  knockdown  drag-out 
since  the  early  1990s. . .  .When  AT&T 
stood  up  and  said  ‘We’re  not  going  to  lose 
on  price,’  that  probably  put  a  lot  of  their 
customers  on  alert.  ■ 
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BaCkSpm  Mark  Gibbs 

“ 321  Studios  regrets  to  inform  you 
that  it  has  ceased  business  opera¬ 
tions.  . . .  Despite  321  Studios' best 
efforts  to  remain  in  business,  injunc¬ 
tions  entered  against  321  Studios  by 
three  U.S.  federal  courts  earlier  this 
year  has  resulted  in  321  Studios  no 
longer  being  able  to  continue  operat¬ 
ing  the  business. . . .  The  employees  and  those  associ¬ 
ated  with  321  Studios  sincerely  appreciate  your  sup¬ 
port  of  our  company  and  products  over  the  last  cou¬ 
ple  of  years.” 


Going,  going . 


—  The  home  page  of  321  Studios 
(www.321studios.com),  Aug.  4,  2004 


How  do  you  kill  off  a  company  of  400  employees 
and  projected  earnings  of  more  than  $150  million  in 
a  few  months?  Easy,  sic  the  dark  forces  of  the  enter¬ 
tainment  industry  and  their  cohorts  on  them. 

In  just  a  few  months  the  financial  damage  caused 
by  fighting  the  deep  legal  pockets  of  the  Motion 
Picture  Association  of  America  (MPAA)  in  the  guise 
of  the  Paramount  and  Fox  movie  studios  in  collabo¬ 
ration  with  computer  games  publishers  Atari,  Elec¬ 
tronic  Arts  and  Vivendi  Universal  Games,  and  aided 
and  abetted  by  Macrovision,  a  purveyor  of  digital 
rights  management  and  software  licensing  systems, 
managed  to  strangle  the  life  out  of  321  Studios,  the 


. .  321 , gone 


publisher  of  a  DVD  cloning  utility 

In  effect,  Goliath  beat  David  to  a  pulp.  Why  would 
this  have  happened? 

The  complainants  contended  that  32 1  ’s  DVD  copy¬ 
ing  software  violated  the  ill-conceived  1998  Digital 
Millennium  Copyright  Act  (DMCA). The  DMCA  pro¬ 
hibits  attempts  to  circumvent  any  anti-piracy  systems 
used  to  protect  digital  content.To  copy  a  DVD 
requires  copying  the  encrypted  content,  so  gotcha! 
But  321  argued  that  to  prohibit  the  sale  of  its  utility 
would  be  to  say,  in  effect,  that  consumers  had  no 
right  of  “fair  use.” 

Fair  use  is  an  important  concept  in  this  argument. 
According  to  the  Electronic  Frontier  Foundation 
(www.nwfusion.com,  DocFinder:  3243):“The  Copy¬ 
right  Act  gives  copyright  holders  the  exclusive  right  to 
reproduce  works  for  a  limited  time  period.  Fair  use  is 
a  limitation  on  this  right. . . .  Fair  use  allows  con¬ 
sumers  to  make  a  copy  of  part  or  all  of  a  copyrighted 
work,  even  where  the  copyright  holder  has  not  given 
permission  or  objects  to  your  use  of  the  work.” 

In  other  words,  fair  use  says  you  can  make  back-up 
and  archive  copies  of  copyrighted  material  for  your 
personal  use  or  change  the  format  of  the  contents 
for  personal  use.  But  the  DMCA  says  you  can’t  do 
any  of  this  if  the  content  is  locked  down  by  an  anti¬ 
piracy  system. 

While  the  conflict  between  the  DMCA  and  the 


copyright  act  is  worrying,  killing  off  321  was  simply 
ridiculous.  Dozens  of  publishers  offer  nearly  identi¬ 
cal  tools  for  both  fee  and  free. 

Mind  you,  this  kind  of  insane  and  reckless  power 
wielding  by  the  entertainment  companies  isn’t 
unusual.  Hank  Barry  and  John  Hummer,  general 
partners  in  Hummer  Winblad  Venture  Partners,  are 
still  being  personally  sued  by  Universal  Music  and 
EMI  for  their  investments  in  Napster  in  early  2000! 
Again,  what’s  the  point? 

Fred  von  Lohmann, senior  intellectual  property 
attorney  at  the  Electronic  Frontier  Foundation, 
agreed  there  is  no  apparent  point  other  than  keep¬ 
ing  lawyers  employed  and  suggested  there  is  an¬ 
other  objective: “These  lawsuits  are  about  one  thing: 
keeping  innovators  intimidated  in  an  effort  to  chill 
the  development  of  disruptive  digital  technologies.” 

This  means  the  course  of  our  industry  can  be 
changed  and  the  employment  of  thousands  of  peo¬ 
ple  affected  not  because  some  great  wrong  is  being 
righted  but  because  some  lawyers  need  employ¬ 
ment.  Is  peer-to-peer  file  sharing  still  around?  Abso¬ 
lutely  Can  you  still  get  a  DVD  cloning  tool?  No  prob¬ 
lem.  But  Napster  and  321  are  history  Well  done,  all 
you  corporate  lawyers. 

What  can  we  do  about  this ?  We’ll  discuss  that  next 
week.  Lawyer  jokes  to  backspin@gibbs.com. 
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By  Paul  McNamara 

Divergent  views  of  e-voting 

Electronic  voting  machines  scare  the 
bejesus  out  of  IT  security  experts,  while 
the  general  populace  finds  them  no  more  threatening  than  an  automated  teller 
machine.  If  nothing  is  done  to  quell  the  concerns  of  the  first  group  before  the 
November  presidential  election,  the  second  group  might  come  to  rue  its  misguided 
confidence  in  such  technology. 

That's  the  essence  of  a  two-pronged  survey  conducted  by  the  Ponemon 
Institute,  a  research  outfit  affiliated  with  Carnegie  Mellon  and  the  International 
Association  of  Privacy  Professionals.The  authors  sought  to  compare  “expert” 
attitudes  about  e-voting  with  prevailing  “public”  sentiment  in  the  midst  of  a  roiling 
nationwide  debate  about  the  increased  use  of  touchscreen  balloting  machines 
that  create  no  verifiable  paper  trail.  It's  important  to  note  that  the  public  portion 
of  the  survey  polled  about  3,000  individuals  and  was  conducted  using  scientific 
methods,  while  the  expert  sample  was  just  that,  a  sample  culled  from  questioning 
100  attendees  at  the  2004  Black  Hat  and  DefCon  conferences.  Nevertheless,  the 
two  sets  of  findings  offer  a  stark  and  alarming  contrast: 

•  75%  of  the  public  has  confidence  or  significant  confidence  in  e-voting,  while 
81%  of  the  experts  have  none  or  little. 

•  79%  of  the  public  believes  e-voting  is  as  likely  or  more  likely  to  accurately 
record  and  report  their  votes  as  paper  ballots,  while  half  of  the  experts  see  e-vot¬ 
ing  as  less  likely  to  be  accurate. 

•  Half  of  the  public  respondents  consider  e-voting  to  be  more  or  much  more 
secure  than  paper,  whereas  83%  of  the  experts  say  it’s  less  or  much  less  so. 

•  More  than  half  of  the  experts  expressed  concern  about  system  and  program¬ 
ming  errors  and/or  attempts  to  rig  an  election  that's  conducted  via  e-voting,  while 
less  than  one-quarter  of  the  public  registered  similar  concerns. 

What  we  have  here  is  a  failure  to  communicate;  specifically,  a  failure  on  the  part 


of  those  who  know  better  to  communicate  their  fears  to  those  who  don't.  On  the 
one  hand,  it's  not  exactly  a  revelation  that  many  among  us  presume  technology  to 
be  unrealistically  reliable,  if  not  infallible.  Nor  is  it  a  surprise  that  those  who  do 
understand  its  limitations  would  be  more  concerned  about  e-voting  than  those 
who  don't. 

What  matters  most  is  what  if  anything  is  going  to  be  done  about  it.  So  far,  the 
answer  looks  to  be  not  much,  at  least  among  the  political  class  that  holds  the 
power  to  insist  on  the  proper  back-up  mechanisms  as  more  election  officials  in 
more  states  turn  to  touchscreen  technology. 

Which  isn’t  to  say  no  one  is  acting.  While  a  majority  of  the  public  might  be  san¬ 
guine  about  e-voting,  many  who  hold  the  more  realistic  view  are  taking  matters 
into  their  own  hands  to  ensure  that  their  votes  actually  get  recorded  and  counted: 
They’re  applying  for  absentee  ballots.  Florida's  Palm  Beach  County  has  received 
more  than  15,000  requests  for  absentee  ballots  for  an  Aug.  31  primary  election, 
three  times  more  than  were  sought  four  years  ago.They’re  expecting  125,000 
absentee  votes  in  November,  up  from  47,000  in  2000. 

It’s  a  pity  that  people  have  to  go  that  far —  in  part  because  absentee  ballots 
present  their  own  set  of  problems  —  but  who  can  blame  them  . . .  especially  in 
Florida,  where  election  officials  were  forced  to  admit  recently  that  they  had  lost 
electronic  records  of  a  2002  gubernatorial  primary  election  that  was  decided  by  a 
few  hundred  votes. 

Citizens  wouldn’t  be  tempted  to  go  that  far  if  only  their  elected  leaders  would 
do  what  they  should  have  done  from  the  start:  Insist  that  touch-screen  voting 
machines  produce  a  paper  trail  that  would  assure  voters  that  their  intentions 
were  accurately  recorded  and  provide  the  mechanism  fora  recount  if  necessary. 

One  final  point:  What's  up  with  the  roughly  one  in  five  “experts"  polled  by 
Ponemon  who  apparently  share  few  if  any  of  their  colleagues’  concerns  about 
e-voting?They  might  be  right,  of  course  ...  but  they  aren’t. 
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HP  Blades,  now  in  a  bundle,  which  is  exactly  what  you'll  save. 
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Save  over  30%  with  our  blade  bundle  featuring  two  HP  ProLiant  BL20p  Blade  Servers,  powered  by  Intel®  Xeon™  processors,  and  get  the  power  to 
make  network  management  simple  and  affordable.  You'll  save  on  deployment  time  too,  thanks  to  this  ready-to-go  package.  Sure,  modular  design 
leaves  room  to  expand  later,  but  HP  Blade  Servers  can  also  make  a  big  impact  on  your  total  cost  of  ownership  in  the  meantime.  Our  management 
software  boosts  productivity  and  cuts  reconfiguration  efforts  from  days  to  minutes.  And  because  your  time  is  money,  the  BL20p  features  fully 
redundant  technologies  to  reduce  costly  downtime.  While  our  #1  ranking  in  lntel*-based,  server-customer  satisfaction  is  one  reason  we  recently  became 
the  first  to  sell  over  1  00,000  blade  servers,  there's  more  than  one  reason.  You  also  get  the  advice  and  support  of  HP  and  our  local  partners  — well 
before  and  long  after  you  buy.  Even  when  you  buy  at  more  than  30%  off. 


Save  33% 

Get  the  HP  ProLiant  BL20p  bundle, 
and  you'll  save  big  compared  to 
the  cost  of  buying  the  two  servers 
and  accessories  separately. 


HP  PROLIANT  BL20p  BLADE 
SERVER  BUNDLE 

(h  Q  Lease  for  as  low  as 

^Oj/r  7  $375  a  month 

•  (2)  BL20p  Blade  Servers 
Each  Blade  Server  includes: 

-  (2)  Intel®  Xeon™  processors  3.06GHz-512k 

-  (3)  10/100/1000  NICs  +  (1)  10/100  iLO  NIC 
■  1GB  DDR  memory2 

•  p-Class  blade  enclosure 

•  p-Class  single  phase  power  enclosure 
with  2  power  supplies 

•  Mini  bus  bar  kit 

•  (8)  Rapid  Deployment  Pack  licenses 
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Download  information  about  HP  Blade  servers. 

Read  a  white  paper  highlighting  total  cost  of  ownership  and  the  Factiva  and 
iSource  case  studies  demonstrating  ROI. 

CALL 

1-877-726-8112 

CLICK 

hp.com/go/blades9 

VISIT 

your  local  HP  reseller 

Otter  avanaxe  when  bought  drrect  from  HP  or  from  participating  authored  resellers  Prices  shown  are  HP  direct  prices,  reseller  and  retailer  prices  may  vary  Prices  shewn  are  subfect  to  change  and  do  not  indude  applicable  sate  and  local  sales  tares  or  shipping  to  recipient's  destina-xn  HP  is  net  liat»e  tor  edrtonal,  pictorial  or  typographicai 
etrors  in  this  advertisement  Photography  may  not  accurately  represent  exact  configurations  priced.  Otters  cannot  be  combined  with  any  other  offer  or  discount  and  are  good  while  supplies  last.  Limited  order  quantities.  Promotions  void  where  prohibited  or  restricted  by  law.  'Implicit  tease  ram,  assuming  lessee  does  not  exercise  a  tar 
market-value  purchase  option  at  the  end  ol  the  lease  term  and  ninety  returns  the  leased  equipment  to  Hewlett-Packard  Financial  Services  Corporation  (HPFSC)  at  the  end  of  the  lease  term  and  disregarding  any  charges  payable  by  lessee  other  than  rent  payments  (such  as  taxes  fees  and  shipping  d  ages).  Lease  products  available  through 
HPFSC  to  qualified  commercial  customers  m  the  U  S  and  subject  to  credit  approval  and  execution  of  standard  HPFSC  documentation  Other  restrictions  may  apply  HPFSC  reserves  the  right  to  change  or  cancel  this  program  at  any  time  without  notice  For  more  information,  cal  1-888  for  hard  drives.  G8*ntfion  bytes.  Certa- 

watranty  restrictions  and  exclusions  may  apply.  For  complete  warranty  details,  call  1  -800-345-1518  (U.S.).  Intel.  Intel  Inside,  the  Intel  Inside  Logo  and  Intel  Xeon  are  trademartrs  or  registered  trademarks  of  Intel  Corporation  or  its  subsidiaries  in  the  United  States  and  other  countries  ©20C4  Hewlett  Packard  Development  Company  • 
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Virus  Outbreaks? 


Introducing  IronPort  Vims  Outbreak  Filters 

Today’s  email  borne  viruses  propagate  globally  in  hours  or  minutes,  much 
faster  than  traditional  defenses  can  react,  leaving  you  exposed  to  the  “reaction 
time  gap’.’  IronPort’s  Virus  Outbreak  Filters™  stop  viruses  4  to  6  hours  before 
traditional  virus  definition  files  are  available,  literally  predicting  virus  attacks 
before  they  cause  harm.  Predict  your  future  at  www.ironport.com/nw 

Q  IRONPORT" 

Rebuilding  the  World’s  Email  Infrastructure. 


POWERED  BY 

A/Vi 

IronPort's  A/Vi  technology 
is  a  series  of  algorithms 
that  process  data  from 
SenderBase.'the  world's 
largest  email  traffic 
monitoring  network. 
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